How to investigate emerging risks related to cross chain crime

Key findings

• Cross-chain crime is now a primary method for laundering stolen crypto. Criminals use bridge protocols and coin swap services to move funds across multiple blockchains, creating complex trails that single-chain tools cannot follow.

• The “dead end” problem, where funds appear to stop on one blockchain but have actually moved to another via a bridge, is the central investigation challenge. Bridge detection technology that automatically connects source and destination addresses across chains now exists, but was not available when this webinar was recorded.

• High-profile cases such as the Atomic Wallet hack ($100M+, linked to the Lazarus group) and the Bybit hack ($1.4 billion, February 2025) demonstrate the scale and sophistication of cross-chain laundering by state-sponsored threat groups.

• Cross-border collaboration between law enforcement, regulators, and the private sector remains essential. Presenting reliable, court-ready evidence requires tools that can visualize cross-chain fund flows clearly for non-technical audiences.

• The investigation landscape has advanced significantly since this webinar. Automated cross-chain tracing, bridge detection, and off-chain victim intelligence have reduced what was previously days of manual work to a largely automated process.

For our recent webinar, we invited a panel of experts to discuss cross-chain crime, chain hopping and how criminals are using these techniques for money laundering and other illicit crypto activities.

Cross-chain refers to transferring assets between different blockchain networks, while chain hopping involves moving funds in steps across multiple chains.

Moderator: Head of Compliance and Regulations, Hedi Navazan @ Crystal

Speaker: Head of Investigations, Scott Pounder @ Crystal

Speaker: Rob Moore, Founder @ Arrowsgate, specializes in cyber security and investigation

Editor’s note: This webinar was recorded in 2023. Since then, the cross-chain investigation landscape has evolved significantly. We’ve added editorial updates throughout to reflect how our panelists’ challenges are being addressed today.

Challenges of decentralized services

Our guest speaker, Rob Moore, Managing Partner from Arrowsgate, a cybersecurity firm from the UK, shared his experience and insights on fraudulent schemes related to coin swap services. He highlighted that criminals use chain-hopping techniques for money laundering and other illegal purposes. He emphasized that the vulnerabilities of decentralized and centralized services lie in identification and verification.

Criminals and high-risk entities often exploit decentralized services, custom bridges, and coin swap services for money laundering and other illicit crypto activities. These services are attractive to criminals because they don’t require users to open accounts or verify their identities, making them vulnerable to malicious activities.

What are coin swapping services?

Decentralized services run on smart contracts and enable cross-asset swaps within the same blockchain. Cross-chain bridges, on the other hand, are decentralized services that facilitate asset swaps across different blockchain platforms. Coin swap services, mostly centralized platforms, allow anonymous exchanges between assets. The absence of identification verification makes these platforms appealing to criminals.

Tracing crypto using blockchain analytics

Rob highlighted how Crystal’s solution tracks and analyzes funds in fraudulent activities, following them to identify their destination and deanonymize crypto addresses. Centralized exchanges with Know Your Customer (KYC) policies are often targeted and used to cash out or cross-chain swap funds.

However, without disclosure from the exchange, the exact actions taken by the perpetrators remain unknown until data are obtained, and further analysis can be conducted. Using Crystal, funds can be tracked relatively quickly, unless they are hidden behind private addresses.

Using blockchain analytics tools for court reports

Rob pointed out that analyzing where the funds end up is usually the fastest part while writing up the findings and preparing them for court is a more time-consuming task.

Ensuring the report is clear and understandable by lawyers and judges is crucial. Criminals are increasingly using cross-asset, cross-chain transactions to obfuscate their illicit activities.

Blockchain analytics tools like Crystal are designed to trace such activities. However, not all tools can demonstrate chain hopping. Access to a blockchain data analytics tool is necessary to manually track and analyze these transactions. Using blockchain analytics tools to trace funds, identify illicit activities, and prepare evidence for legal proceedings is valuable to understand complex cross-chain activities.

The role of cross-chain visualizations in tracking illicit activity

The complexity of the crypto ecosystem arises from the various blockchain networks, each with its own protocols, structures, and transaction formats. Tracking transactions across multiple chains requires a deep understanding of these intricacies and the ability to navigate through different blockchain explorers and APIs.

Many blockchain networks operate independently, making it challenging to seamlessly connect and trace transactions across different chains. Unique addressing schemes and transaction formats further complicate the manual mapping and correlation of addresses and transactions across chains. As the number of transactions increases, this process becomes even more time-consuming.

The dead-end problem: when funds disappear across chains

One of the central challenges discussed in this webinar was the “dead end” problem. An investigator traces funds on one blockchain and reaches an address where activity appears to stop. No further transactions, no withdrawal. In reality, the funds moved to a different chain via a bridge protocol, but without dedicated bridge detection, that connection is invisible.

Since this webinar was recorded, bridge detection technology has emerged that directly addresses this gap. When an investigator encounters a transaction where funds appear to stop, bridge detection can identify the transfer as a cross-chain bridge transaction and show where the funds continued on the destination chain.

For example, an investigator analyzing suspicious activity on Tron identifies a transaction where funds are sent to an address, after which no further activity is visible on Tron. With bridge detection, the system identifies this as a bridge transaction and shows that funds moved to Ethereum. The investigator continues the analysis seamlessly on the destination chain.

Over 75 bridge protocols are now in common use across Ethereum, Bitcoin, Tron, Solana, Polygon, Arbitrum, Base, and Optimism. The ability to detect and follow bridge transactions automatically has transformed what was, at the time of this webinar, one of the most frustrating limitations in cross-chain investigation.

Privacy is another hurdle

Specific blockchain networks, particularly privacy-centric crypto, have enhanced privacy features that can obscure transaction details. This aspect makes it difficult to trace funds manually, further complicating the process.

In addition to the above challenges, the manual tracking process requires significant time and resources. Even for a simple payment, it could take weeks to manually track its whereabouts. Human error and other potential issues further contribute to the uncertainty of obtaining accurate results.

Law enforcement has previously relied on manual tools due to limited options and access to blockchain-specific tools in the past. However, the process has become easier with the emergence of blockchain analytics tools like Crystal. These tools provide visualizations and other features that facilitate the tracking and analysis of transactions.

Since this webinar, the speed gap has narrowed further. Automated path discovery can now build all paths between two entities in seconds, compared to the 30+ minutes of manual graph construction that investigators relied on in 2023. Combined with automated cross-chain tracing that covers the majority of swap operations, investigations that previously required days of manual work can now be completed in a fraction of the time.

Atomic Wallet hack: a cross-chain investigation in practice

Scott demonstrated how cross-chain visualization works in practice using the Atomic Wallet hack as a case study. The attack, which resulted in over $100 million in crypto losses, involved funds moving across multiple blockchains, including Ethereum Classic, Litecoin, Bitcoin, Tron, USDC, and USDT. His visualization showed how Crystal maps these movements across chains in a single view.

By selecting each blockchain individually and examining the associated transactions, received and sent amounts, and current balances, investigators can build a complete overview of fund movements. The shortest paths to known entities, primarily exchanges, are identified on each chain. The visualization then brings these separate chains together, showing how funds were converted between tokens and bridged across blockchains before ultimately flowing into a single licensed exchange.

This is where the investigative value becomes clear. Licensed exchanges are required to conduct KYC, making them the natural point for legal inquiries and information requests. The analysis focuses on tracing the paths stolen funds took and identifying the exit points where law enforcement can take action.

Without cross-chain visualization, reconstructing these fund flows manually across different blockchains and tokens is time-consuming and often impractical. Each chain has its own explorer, addressing format, and transaction structure. The ability to connect these into a single view turns what could be weeks of manual work into a structured, traceable investigation.

The hack of Atomic Wallet raises broader topics related to cybersecurity, wallet security, and the tactics employed by hackers. The attack is believed to be linked to the North Korean hacking group Lazarus.

A more recent example: the Bybit hack (February 2025)

Since this webinar, the Bybit exchange hack in February 2025 provided another high-profile example of cross-chain laundering at scale. Approximately $1.4 billion in crypto assets were stolen in an attack attributed to the same North Korean threat group. The attackers used bridge protocols to distribute stolen funds across multiple blockchains within hours, demonstrating how cross-chain movement has become the default laundering strategy for sophisticated threat actors.

The Bybit case highlighted exactly the type of investigation challenge discussed in this webinar, but at an even larger scale. With bridge detection now available across 75+ protocols, investigators have significantly more visibility into these cross-chain movements than was possible at the time of the Atomic Wallet case. 

Presenting reliable and traceable data

Our webinar also touched on romance scams, the emotional difficulties of informing victims that their online relationships were part of a scam, and the subsequent challenges of convincing them that further payments will not unlock their funds. Sometimes, we even see a double scam scenario in which fraudsters pose as asset recovery firms or law enforcement to extort more money from victims. Educating judges and the judiciary system about crypto-related crimes is essential, as they may not yet have gained the necessary knowledge or understanding of the technology. Simplifying complex concepts through visualizations and avoiding excessive technical jargon are recommended when presenting evidence to non-technical audiences such as judges and juries. While challenges in providing evidence have been manageable thus far, we need to ensure that the presented data is reliable and traceable to the source.

Since this webinar, victim-reported intelligence has become an increasingly valuable resource for investigators. Platforms that allow victims to report scam addresses and associated details create a feedback loop: investigators can cross-reference addresses against real-world victim reports, while new reports help flag addresses that might not yet appear in attribution databases. This off-chain intelligence layer adds context that on-chain data alone cannot provide, particularly for investigations into scams and fraud. 

Cross-border collaboration

Our experts agreed on the importance of cross-border collaboration among supervisory and law enforcement agencies to implement regulations and combat illicit activities. Our Head of Compliance and Regulatory Affairs, Hedi Navazan, highlighted the difficulties of exchanging intelligence and coordinating efforts across different countries, citing the example of shutting down the Hydra market, which required extensive cross-border collaboration over several years. Collaboration between the private and public sectors and harmonization across borders are essential.

We addressed the issue of law enforcement agencies refusing to cooperate or review analyzed data, and we shared an example in which obtaining information from an exchange in a different country proved challenging due to the need for mutual collaboration between cross-border agencies. Similar cases are cited in which local police or law enforcement lacked the knowledge, training, or resources to take appropriate action, resulting in missed opportunities to address criminal activity. The need for better training and resource allocation is crucial to ensure effective collaboration and investigation.

The future of crypto investigations

Our recent webinar shed light on cross-chain crime and the chain-hopping techniques criminals use for money laundering and other illicit crypto activities.

The complexity of the crypto ecosystem, with its various blockchain networks and transaction formats, poses significant challenges for tracking and tracing funds across multiple chains. Manual processes are time-consuming, prone to human error, and often yield uncertain results.

As the crypto landscape evolves, it is essential to stay informed about the techniques used by criminals, use advanced tools for analysis, and foster international cooperation to combat crypto-related crimes effectively.

How Crystal supports cross-chain investigations

Since this webinar was recorded, Crystal has launched several capabilities that directly address the challenges discussed by our panelists. Bridge detection across 75+ protocols automatically identifies when funds cross chains and connects source and destination addresses. Automated swap tracing covers 92-95% of swap operations across supported blockchains. One-click path discovery builds investigation paths in seconds. Scam Alert integration brings off-chain victim-reported intelligence into the investigation workflow, with 15,000+ scams reported and 138,000+ addresses flagged. Crystal now covers 100,000+ attributed entities across 330+ blockchains and 10,000+ digital assets.

Frequently asked questions

What is cross-chain crime?

Cross-chain crime involves using bridge protocols and coin swap services to move illicit funds between different blockchains. By transferring stolen or laundered crypto across multiple chains, criminals create complex trails that are harder to trace than single-chain transactions. It has become a primary laundering technique since 2022.

What is chain hopping, and how is it different from cross-chain transfers?

Cross-chain refers broadly to transferring assets between different blockchain networks. Chain hopping refers to moving funds step by step across multiple chains to obscure the trail. In practice, criminals combine both techniques, using bridge protocols for cross-chain transfers and performing multiple hops across chains to make tracing more difficult.

What is the dead-end problem in cross-chain investigations?

When an investigator traces funds on one blockchain and reaches an address where activity appears to stop, the funds may have actually moved to a different chain via a bridge protocol. Without bridge detection, that connection is invisible, and the investigation hits a dead end. Bridge detection technology now automatically identifies these cross-chain transfers, connecting source and destination addresses across chains.

Can cross-chain crypto movements be used as evidence in court?

Yes. Cross-chain visualization tools can present complex cross-chain fund flows in a clear, understandable format suitable for non-technical audiences such as judges and juries. Address-level path analysis provides the granularity needed for court submissions, showing exactly which wallets were involved at each stage of a cross-chain transfer.