Cross-Chain Money Laundering: How Criminals Move Funds Between Chains

Money laundering in crypto has evolved beyond single-chain mixing. Modern laundering operations use cross-chain bridges and decentralized exchanges to move funds across multiple blockchains, creating forensic dead ends.

According to Elliptic's 'State of Cross-Chain Crime 2025' report, the total value laundered through cross-chain mechanisms has surpassed $21.8 billion — nearly three times the 2023 figure and far exceeding earlier projections of $9–$15 billion. North Korean hackers alone account for approximately $2.7 billion (12%) of this total. An additional $300 million was traced to Iranian crypto services under U.S. sanctions.

The mechanism is straightforward: 1. Steal funds on Chain A (e.g., Ethereum) 2. Swap to a different asset via a DEX (e.g., ETH → DAI) 3. Bridge to Chain B (e.g., Ethereum → Polygon via a bridge) 4. Swap again on Chain B (e.g., DAI → USDC) 5. Bridge to Chain C (e.g., Polygon → Arbitrum) 6. Cash out via a P2P merchant or low-KYC exchange on Chain C

Chainalysis's 2026 Crypto Crime Report reveals that total illicit cryptocurrency transactions reached $154 billion in 2025 — a 162% increase from 2024. Sanctioned entities alone received $104 billion, a 694% YoY jump.

Based on intelligence analysis and public reports, the dominant techniques are:

1. Bridge exploitation: Cross-chain bridges (Multichain, Wormhole, Stargate) are used to transfer value while changing the asset identifier. Post-Tornado Cash delisting (March 2025), bridges have absorbed much of the obfuscation demand.

2. DEX aggregator routing: Services like 1inch and Paraswap split trades across multiple liquidity pools, making the fund flow appear as normal trading activity rather than laundering.

3. Peel chains: An address sends a small amount to a destination, then sends the remainder to a new address, and repeats. Each "peel" creates a new address, making automated tracking difficult. Elliptic found peel chains remain one of the most effective obfuscation methods.

4. Privacy chains: While diminished since the Tornado Cash enforcement era, some operators still use Monero, Zcash (with shielded transactions), or Litecoin MWEB as intermediate hops.

5. Token creation: Sophisticated operators create custom ERC-20/TRC-20 tokens, provide temporary liquidity, swap stolen funds for their token, then redeem the token for a different stablecoin on another chain.

Elliptic data shows that over a third of complex cross-chain investigations now span more than 3 blockchains, 27% involve more than 5, and 20% extend across more than 10 different chains. A study of major crypto heists in 2025 reveals a consistent pattern:

• Average number of chains used in a laundering operation: 3–5 (up from 2–3 in 2023) • Average number of intermediary wallets: 15–50 • Time from theft to first fiat off-ramp: 4–72 hours • 88% of financial firms now deploy AI/ML-powered AML systems to counter cross-chain threats

An AML tool that only analyzes Ethereum will miss the TRON-based cash-out. A tool that only screens BTC will not detect when stolen ETH is bridged to BTC via a cross-chain swap.

This is why Sanctuary screens across 35+ chains, with full AML coverage on 10 core networks: Ethereum, Bitcoin, TRON, Solana, TON, BSC, Polygon, Arbitrum, Optimism, and Base. When we score a wallet on Ethereum, we also check if the address cluster has connected activity on other supported chains.

Effective cross-chain laundering detection requires:

1. Cross-chain address clustering: Identifying addresses controlled by the same entity across multiple chains (same derivation path, coordinated timing, shared exchange deposit addresses).

2. Bridge transaction monitoring: Tracking bridge deposits and withdrawals, matching amounts (minus fees) across chains within narrow time windows.

3. Behavioral fingerprinting: Even across chains, human operators have behavioral signatures — timing patterns, preferred denomination sizes, gas/fee management habits.

4. Intelligence aggregation: Combining on-chain data with off-chain intelligence (community reports, sanctions lists, exchange correspondence) to connect fragments.

Sanctuary's multi-chain scoring aggregates signals across all 10 supported chains, enabling detection of cross-chain laundering patterns that single-chain tools miss.