Single chain tracing, following stolen Bitcoin from address to address on the Bitcoin blockchain, is difficult enough on its own, as covered in our guide on how to trace stolen Bitcoin. Modern theft cases add another layer of complexity, because stolen funds today rarely stay on one blockchain. They get bridged to another network, swapped for a different asset, and moved again, sometimes within minutes of the original theft. This guide explains how that cross chain movement is actually tracked.
Why Thieves Move Funds Across Chains
Moving stolen funds across blockchains is not primarily about hiding from a technical standpoint, since every chain involved is still public. It is about breaking the continuous, single ledger view that makes single chain tracing straightforward. When funds leave Ethereum and arrive on a different network as a different token, a tool built only to watch Ethereum simply loses the trail at that point, even though the funds have not actually disappeared.
It also serves practical purposes for a thief: reaching liquidity venues, decentralized exchanges, or services available on a different network, and in many cases specifically targeting chains or bridges known to have weaker compliance controls or slower cooperation with investigators.
How a Cross Chain Bridge Actually Works
A bridge is a protocol that lets a user move value from one blockchain to another. Mechanically, this usually happens one of two ways. In a lock and mint model, the original asset is locked in a smart contract on the source chain, and an equivalent wrapped token is minted on the destination chain. In a liquidity pool model, the user deposits an asset into a pool on the source chain and a corresponding amount is paid out from a matching pool on the destination chain, without the original tokens being locked in the same way.
Either way, a bridge transaction leaves records on both sides, a deposit or lock event on the source chain, and a mint or payout event on the destination chain, usually within a short and identifiable time window and often for a closely matching amount. That correspondence, timing and amount, is the primary hook investigators use to reconnect the two halves of the trail.
Custodial bridges versus trustless bridges
A distinction that matters more for legal action than for the tracing math itself is whether a bridge is custodial, meaning a company or foundation controls the locked funds and operates the minting process, or trustless, meaning the process is governed entirely by smart contracts and a decentralized set of validators with no single controlling operator. A custodial bridge is a chokepoint in its own right, since the operating entity can, in principle, be reached with a subpoena or legal request the same way an exchange can. A fully trustless bridge offers no equivalent legal target, which means the trail has to be followed all the way through to whatever chokepoint the funds eventually reach on the destination chain, since the bridge protocol itself offers no one to compel.
The Actual Method: Correlating Both Sides of the Trail
Cross chain tracing works by treating each bridge or swap as a linking event rather than an endpoint. The process generally follows these steps:
- Confirm the exact transaction where stolen funds enter a known bridge contract or swap protocol on the source chain, along with the precise amount and timestamp
- Query the destination chain, or in the case of a bridge that supports several destinations, each candidate chain, for a matching mint, payout, or deposit event within a plausible time window
- Match amounts, accounting for bridge fees, exchange rate conversions, and typical processing delays, to narrow down which destination chain transaction corresponds to the source event
- Resume standard address clustering, using the heuristics described in our Bitcoin tracing guide adapted to the account or UTXO model of the new chain, from the newly identified destination address
- Repeat this process for every subsequent bridge or swap the funds pass through, building a connected multi chain map rather than several disconnected single chain fragments
Modern blockchain intelligence platforms automate much of this correlation, maintaining databases of known bridge and mixer contract addresses and applying pattern matching across dozens of chains simultaneously, which is what turns what would otherwise be weeks of manual cross referencing into a structured, timely investigation.
Common Misconception: Wrapped Tokens Break the Chain of Ownership
A frequent misunderstanding is that once an asset is bridged and becomes a wrapped token, meaning a representation of the original asset issued on a new chain, such as wrapped Bitcoin on Ethereum, it somehow severs the link back to the original stolen funds. It does not. A wrapped token's entire purpose is to represent a specific locked amount of the original asset on a one to one basis, and the minting event that creates it is itself a transaction recorded on the destination chain, tied by timing and amount back to the lock event on the source chain. Investigators do not need to treat a wrapped asset as a fresh, disconnected asset. They treat the wrap itself as another link in the same continuous chain of custody, no different in principle from a peel chain hop on a single blockchain.
A Worked Example: Following Funds Across Two Chains
Consider funds stolen from an Ethereum wallet in a phishing attack. The thief immediately moves the funds into a bridge contract, locking the stolen ETH and receiving an equivalent wrapped asset on a separate, faster and cheaper blockchain, specifically to reach decentralized exchanges available there. An investigator tracing the case first confirms the exact amount and timestamp of the lock event on Ethereum, then queries the destination chain for a matching mint event within the bridge's typical processing window, generally minutes for most modern bridges.
Having matched the two events, the investigator resumes clustering on the destination chain, where the thief swaps the wrapped asset for a stablecoin through a decentralized exchange, then sends that stablecoin to a centralized exchange to cash out. Even though the funds crossed from Ethereum to a separate chain and were converted twice along the way, the trail remains continuous: lock event, matched mint event, decentralized swap, and finally a deposit at an identifiable, regulated exchange, which becomes the chokepoint for a legal referral in exactly the same way a single chain Bitcoin case would resolve.
Mixers and the Chain Hopping Problem
Mixing services add a deliberate obfuscation step, pooling funds from many different depositors and paying out from that shared pool rather than a direct one to one transaction, which weakens the timing and amount correlation that cross chain tracing normally relies on. Following sanctions actions and law enforcement takedowns against several major mixing services in recent years, a portion of illicit activity has shifted toward chaining several cross chain bridges together instead, since fast, high volume bridge hopping produces a similar obfuscating effect for less operational risk.
This does not defeat tracing outright. Investigators increasingly build behavioral fingerprints, patterns in transaction timing, amount structuring, and gas fee payment sources, that can survive even when a single clean timing and amount match is not available. But it does meaningfully increase the effort required and can, in some cases, break the trail entirely at a chokepoint that offers no cooperation.
- Timing correlation, matching a source chain lock or deposit event to a destination chain mint or payout within the bridge's typical processing window
- Amount correlation, accounting for known bridge fees and slippage to confirm a destination event corresponds to a specific source event
- Gas fee funding analysis, since the wallet used to pay for gas on a new chain often has to be funded from somewhere, occasionally revealing a separate address controlled by the same actor
- Known contract labeling, maintaining databases of bridge, mixer, and decentralized exchange contract addresses so that automated tools can recognize a laundering hop the moment it occurs
A trail going cold on one blockchain rarely means the funds have vanished. In most modern theft cases it means the funds crossed a bridge to another network, and the investigation needs to follow that same value onto the new chain rather than treating the original chain as the end of the story.
Where the Trail Leads: The Same Chokepoints, More Steps
Despite the added complexity, the destination of a cross chain trace is usually the same kind of chokepoint described in single chain tracing, a centralized exchange or other regulated service where the funds are eventually converted to spendable value. Multi chain movement adds hops to the journey, but it rarely removes the eventual need for the thief to cash out somewhere that can, in principle, be reached with the right legal process. That is why cross chain cases still resolve, when they resolve, through the same combination of tracing, exchange cooperation, and legal action described in our guide on whether stolen cryptocurrency can be recovered.
A Note on Realistic Expectations for Complex Cases
Cross chain and multi hop laundering cases take meaningfully longer to investigate than a straightforward single chain theft, and the added complexity does reduce the odds of reaching a clean, actionable chokepoint in every case. Coin Trace's case team builds multi chain fund flow maps for exactly these situations, documenting each bridge, swap, and chain transition, but it is honest to say that the more hops a trail crosses, the more that trail depends on cooperation from services along the way, and that cooperation is not something any investigator can guarantee in advance.
Frequently asked questions
No. Every side of a bridge transaction is still recorded on its respective public blockchain. Bridges add complexity by breaking a single continuous ledger view, but investigators correlate the source and destination transactions using timing, amount, and known bridge contract addresses to reconnect the trail.
A bridge moves value between two different blockchains and generally preserves a fairly direct, matchable link between the source and destination transaction. A mixer pools funds from many unrelated depositors on the same chain and pays out from that shared pool, which is specifically designed to break the one to one correlation that tracing depends on, making it a harder obstacle than a typical bridge.
There is no fixed number. Each additional bridge, swap, or mixing step adds cost and effort to the investigation and reduces the odds of a clean match, but funds have been successfully traced across many hops and several different chains in documented cases. The trail typically ends not because of a technical limit but because it reaches a service that will not cooperate or a privacy tool that breaks correlation entirely.
No special permission is needed to analyze public blockchain data itself, since every chain involved is a public ledger. What does require legal process is compelling a private company, such as an exchange or bridge operator, to disclose account identity information or freeze funds once a trail leads to their platform.
Not meaningfully. A wrapped token is created through a mint event tied by timing and amount to a lock event on the original chain, so the wrap itself is just another documented link in the chain of custody rather than a break in it. The harder obstacles are mixers and privacy coins, not wrapping mechanisms used by ordinary bridges.
Sources and further reading
- Cross-Chain Tracing in Crypto: How It Works and Why It Matters · TRM Labs
- Crypto mixers and crosschain bridges: How hackers launder stolen assets · Cointelegraph
- How to investigate emerging risks related to cross chain crime · Crystal Intelligence