Chain-Hopping: How Cross-Chain Bridges Became a Laundering Route, and Why the Trail Survives
Stolen crypto now crosses three or more blockchains in minutes to shake off investigators. Here’s how chain-hopping works, and why the evidence usually survives the journey.
Picture a wallet that has just received stolen funds on Ethereum. Within an hour, part of that money is Bitcoin. By evening, some of it is USDT on Tron, sitting in a wallet that sells to P2P buyers for rupees. At no point did the funds pass through a bank, and at no point did anyone ask for a name.
This is chain-hopping: moving value across blockchains to break the trail. It used to be an advanced tactic. Today it is standard practice.
The scale of the problem
Blockchain analytics firm Elliptic has tracked this trend since 2022. Its 2025 report estimated that illicit and high-risk funds moved through cross-chain methods had passed $21 billion by May 2025, roughly three times its 2023 estimate of $7 billion. In its first edition in October 2022, the figure was $4.1 billion.
The cases are getting more complex as well. Elliptic found that a third of complex cross-chain investigations involved more than three blockchains, and 27% involved more than five.
The shift is partly a response to enforcement. Elliptic observed criminals moving away from mixers towards cross-chain bridges after Tornado Cash was sanctioned in August 2022. When one route closes, laundering moves to another.
What a bridge actually does
Blockchains don’t talk to each other natively. Bitcoin can’t read Ethereum, and Tron can’t read Solana. A bridge is the service that moves value between them. It typically works in one of three ways:
Lock and mint: you lock an asset on Chain A, and an equivalent “wrapped” token is created on Chain B.
Burn and release: the reverse. The wrapped token is destroyed on Chain B, and the original is unlocked on Chain A.
Liquidity swaps: you deposit an asset into a pool on one chain and receive a native asset from a pool on another chain. No wrapped token is involved.
The vast majority of bridge users are ordinary traders and developers moving funds where they need them. For a launderer, though, a bridge offers something useful: it cuts the visible link between one chain’s history and the next.
Why launderers like bridges
It breaks single-chain views. Many monitoring tools look at one chain at a time. Funds that leave Ethereum and arrive as native Bitcoin show up as a “new” wallet with no visible history unless someone connects the two sides.
It hides in legitimate volume. A single bridge transfer looks like any other user’s swap. As Elliptic notes, one bridge transaction may be ordinary behaviour; it is structured, multi-hop patterns that indicate a deliberate effort to break the on-chain trail.
Many routes need no identity checks. Decentralized bridges and no-KYC swap services don’t ask who is on the other end.
It lands funds on the most liquid cash-out rails. For much of the world, and for India in particular, that rail is USDT on Tron. TRM Labs found that Tron hosted 58% of illicit crypto volume in 2024, ahead of Ethereum at 24% and Bitcoin at 12%.
Anatomy of a chain-hop
The details vary, but a typical laundering path looks like this:
Source: funds arrive in a wallet from a hack, scam or fraud.
Split: the balance is broken into many smaller amounts across fresh wallets, so no single transfer stands out.
Swap: tokens are converted into a more liquid asset on the same chain, often through a decentralised exchange.
Hop: the funds cross to another chain through a bridge or cross-chain swap. This step is sometimes repeated several times.
Consolidate: the funds regroup on the destination chain, often as stablecoins.
Cash out: the stablecoins are sold through OTC desks, offshore exchanges or P2P traders.
In India, the final step often connects with the pipelines we described in Money Mules to USDT and After the Ban. Tron USDT is sold to P2P buyers, and the rupees land in rented bank accounts. The chain-hop is the step before that, the part designed to make sure nobody can tell where the USDT came from.
Case in point: the Bybit hack
The largest example to date is the February 2025 Bybit hack. About 500,000 ETH, worth roughly $1.4 billion, was stolen from the exchange on 21 February 2025. The FBI attributed it to the North Korean group known as TraderTraitor, or Lazarus Group.
What happened next was a textbook chain-hop at industrial scale. Within about 115 hours, the hackers had moved at least 161,490 ETH through 3,934 separate bridge transactions to THORChain, according to MetaMask’s Taylor Monahan. By early March, Bybit’s CEO reported that 83% of the stolen ETH had been converted to Bitcoin and spread across 6,954 wallets, averaging 1.71 BTC each. Arkham reported that THORChain had processed more than $5.5 billion in volume after the hack and earned about $5.5 million in fees.
The operation was fast, fragmented and spread across chains. Yet Bybit’s CEO also reported that more than 77% of the stolen funds were still traceable, while 20% had gone dark. The trail was harder to follow, but most of it held.
Why the trail survives
Chain-hopping makes tracing harder. It does not make it impossible, for a few reasons:
Both sides of the bridge are public. A bridge deposit on one chain and a release on another are both recorded on public ledgers. Many bridges and cross-chain swap protocols also log identifiers that link the two sides.
Timing and amounts correlate. Even when no shared identifier exists, a deposit of a given value on one chain is followed by a release of a matching value, minus fees, on another chain shortly after. Across hundreds of transfers, these patterns become strong signals.
Behaviour carries over. Wallets controlled by the same actor tend to behave alike: similar timing, similar amounts, similar routes. Clustering techniques can group addresses into likely entities across chains, not just within one.
Cash-out points are chokepoints. Laundered funds eventually have to touch an exchange, OTC desk, stablecoin issuer or P2P seller. That is where funds can be flagged and frozen. The T3 Financial Crime Unit, run by Tether, Tron and TRM Labs, said in May 2026 that it had helped freeze more than $450 million linked to suspected criminal activity since 2024.
The key is seeing every chain in one connected view, rather than treating each blockchain as a separate case file.
What this means in India
For exchanges: a deposit’s history doesn’t start on your chain. Screening only the last hop can miss funds that came through a bridge minutes earlier.
For P2P traders: USDT bought from a stranger may have crossed three chains since it was stolen. If that USDT is later flagged, the trader holding it, and their bank account, can end up in the investigation.
For banks: rupee inflows from crypto sales may be the final step of a cross-chain laundering path. Patterns such as many small P2P credits feeding a single account are worth a closer look.
For investigators: cases that stop at a bridge are often cases that stopped too early. The money usually keeps moving in plain view on another chain.
The bottom line
Bridges are useful infrastructure, and most of their users are legitimate. But they have also become one of the main tools for laundering crypto, and the numbers are growing quickly. Chain-hopping works on the assumption that nobody is watching every chain at once.
That assumption is increasingly wrong. Every hop leaves a record, and with connected, cross-chain data, those records can be joined back into a single trail.
Nodestors helps teams follow digital-asset movements across supported blockchains with Netra, and work with structured cross-chain data through Datum. Let’s connect.
Disclaimer: This article is for informational purposes only and does not constitute financial, investment or legal advice. Wallet labels and entity attributions are probabilistic assessments, not findings of fact, and do not imply wrongdoing by any person.
