For years, blockchain analysis tools were built around a simple assumption: a stolen coin stays on the chain it was stolen from, and an investigator can follow it hop by hop through that chain's own transaction history until it reaches an exchange. That assumption no longer holds for any sophisticated theft. Today, the first thing a large amount of stolen crypto typically does is leave the chain it was stolen on entirely, moving through a bridge onto a different network where the original tracing tools, and often the original blockchain's own analytics coverage, do not automatically follow.
Analysts sometimes call this the dead end problem. Funds appear to simply stop moving on the chain where a theft occurred, not because they were frozen or lost, but because they crossed into a different blockchain entirely and the person watching the first chain lost sight of them at that exact moment. Solving that problem is now one of the central challenges in any serious cryptocurrency investigation.
How funds actually move between chains
A cross chain bridge allows an asset native to one blockchain to be represented on another, typically by locking the original asset in a smart contract and minting a wrapped equivalent on the destination chain. Decentralized exchange aggregators and cross asset swap services offer a related function, letting someone convert one asset for a completely different one, sometimes across multiple chains, in a single transaction flow. For a deeper look at how bridges work mechanically, see our guide on cross chain bridges.
None of these tools were built with criminal use in mind. They exist because legitimate users want to move assets between ecosystems for trading, yield, or simple convenience. But that same legitimate utility makes them an ideal laundering tool, because moving through a bridge or a cross asset swap breaks the simple, single chain trail that older tracing methods relied on.
Why criminals rely on cross chain movement
Cross chain movement has become close to the default laundering strategy for sophisticated threat actors, and the scale reflects that. Blockchain analytics firm Chainalysis has reported that more than twenty one billion dollars in illicit funds moved through cross chain and cross asset services, including decentralized exchanges and bridges, in a recent one year period. Criminals have adapted specifically in response to improving exchange compliance, adding cross chain hops and mixing steps as additional layers between the theft itself and any point where funds might finally be converted to cash.
- Bridges break the assumption that a single blockchain's transaction history tells the whole story.
- Many smaller or newer bridges have weaker monitoring and compliance coverage than major centralized exchanges.
- Wrapped assets can obscure the original asset's identity, requiring analysts to track the underlying locked collateral separately from the wrapped token circulating on the new chain.
- Moving between ecosystems lets criminals exploit gaps in which analytics platforms have full coverage of which chains.
A documented laundering playbook
Public reporting on North Korean state linked hacking activity, covered in more depth in our guide on state linked hacking groups, describes a distinct and repeatable laundering cycle. Funds are typically moved in tranches kept under five hundred thousand dollars each, spread across roughly a forty five day window, and routed heavily through Chinese language money movement services, cross chain bridges, and mixing protocols rather than moved all at once through a single obvious path. The deliberate pacing and fragmentation are themselves a form of evasion, designed to avoid triggering the size and velocity thresholds that automated compliance monitoring is built to catch.
Common techniques within cross chain laundering
Bridge hopping
Funds are moved through one bridge to a secondary chain, then through a second, unrelated bridge to a third chain, each hop adding a separate protocol, a separate set of smart contracts, and a separate potential gap in monitoring coverage that an investigator has to individually account for.
Layering through decentralized exchanges
Rather than sending stolen funds directly to an exchange deposit address, launderers frequently swap the asset multiple times through decentralized exchanges first, sometimes converting into and out of several unrelated tokens, to add noise and distance between the original theft and the funds that eventually reach a cash out point.
Peel chains across networks
A classic laundering pattern, peeling off small amounts from a large balance into many separate destinations, becomes significantly more complex to follow when each peeled amount can also independently cross to a different blockchain, multiplying the number of paths an investigator has to check at every single step.
Cross chain movement does not make funds anonymous. It multiplies the number of blockchains an investigator has to monitor simultaneously, which is why modern tracing depends on tools built to follow assets across networks rather than within just one.
Regulators have taken notice
The scale of cross chain laundering has drawn direct regulatory attention. In October 2023, the US Treasury's Financial Crimes Enforcement Network, known as FinCEN, took the unusual step of proposing to designate an entire class of transactions, those involving cryptocurrency mixing, as a primary money laundering concern under federal law, rather than targeting a specific company or country as it more typically does. FinCEN specifically pointed to the role mixers played in laundering proceeds from major bridge and DeFi heists, citing the Harmony Horizon Bridge theft and the Axie Infinity theft as examples of how mixing and cross chain movement had already become intertwined in practice. The proposal reflected a recognition that older regulatory tools, built around monitoring individual, licensed financial institutions, were not designed for a laundering pattern that deliberately routes funds through decentralized infrastructure with no single operator to compel compliance.
That kind of regulatory response takes time to translate into enforcement, and it does not retroactively help trace funds that have already crossed several chains in a given case. It does, however, push exchanges and other regulated services to treat any deposit with cross chain or mixer exposure in its recent history as higher risk, which in practice narrows the number of places launderers can safely convert stolen funds into cash without triggering additional scrutiny.
How investigators follow funds across chains anyway
Modern blockchain intelligence platforms are built specifically to correlate activity across dozens of chains at once, matching the locking of an asset on one chain to the minting of its wrapped counterpart on another, and flagging addresses associated with known bridges, mixers, and high risk services regardless of which network they operate on. Our guide on how investigators trace funds across chains covers this methodology directly, and our broader guide on how blockchain tracing works explains the foundational techniques that this cross chain work builds on.
A real world illustration of the speed involved
The laundering activity following the February 2025 Bybit theft, covered in more detail in our guide on recent major exchange hacks, offers a concrete illustration of how quickly cross chain movement can occur at scale. Reporting on that incident indicates that a significant share of the roughly one and a half billion dollars stolen moved through laundering channels, including cross chain routes, within the first forty eight hours alone. A theft of that size moving that quickly across multiple networks is exactly the scenario that makes single chain tracing tools insufficient on their own, and it is part of why the FBI's public response included asking cryptocurrency service providers broadly to block transactions linked to specific addresses, rather than relying on any single exchange or blockchain to catch the activity in isolation.
The practical reality for a victim is that cross chain movement makes an investigation slower and more resource intensive, not impossible. Funds still have to eventually reach a point where they can be converted into spendable currency, and that conversion point, whether a centralized exchange, a peer to peer marketplace, or a payment processor, remains the most realistic place for law enforcement and compliance teams to intervene. A victim or their investigator working a case with cross chain exposure should expect the process to involve multiple analytics platforms and considerably more time than a case where funds stayed on a single, well monitored network throughout, but that added difficulty is a matter of degree, not a reason to assume the case cannot be pursued at all.
Frequently asked questions
No. Every bridge transaction and every swap is itself recorded permanently on the relevant blockchains. What changes is the difficulty of the investigation, since an analyst now has to correlate activity across multiple separate networks instead of following one continuous chain of transactions, which takes more specialized tooling and more time.
Many bridges are decentralized or semi decentralized protocols rather than regulated financial businesses, so they are not subject to the same know your customer and anti money laundering obligations that apply to centralized exchanges. Newer or smaller bridges in particular often have limited compliance infrastructure compared to established exchanges.
Recovery becomes more difficult but is not automatically ruled out. Funds eventually need to reach an exchange or service that can convert them to usable currency, and that point of conversion is where frozen funds and law enforcement cooperation most often occur, regardless of how many chains the funds crossed beforehand.
No, though it is most associated with large, sophisticated thefts because of the scale of illicit volume it involves. Smaller scale scammers increasingly use the same bridges and cross asset swap tools, since they are widely available, require no special technical skill, and are marketed to ordinary users for entirely legitimate purposes.
Sources and further reading
- 2025 Crypto Theft Reaches $3.4 Billion · Chainalysis
- Cross-Chain Crime Hits $21.8 Billion · Croke Fairchild Duarte & Beres
- How to investigate emerging risks related to cross chain crime · Crystal Intelligence
- Treasury proposes designating transactions with cryptocurrency mixers a Primary Money Laundering Concern · DLA Piper