The main trend in cryptocurrency laundering in 2025: cross-chain transfers

By 2025, the cryptocurrency ecosystem is expected to continue growing — there are already hundreds of blockchains and thousands of digital assets — and cybercriminals are actively exploiting this increasingly complex environment, utilizing ever more sophisticated money laundering methods. One of the key methods has become chain-hopping — quickly switching between networks and assets, which has become a defining tool in modern crypto crime. GetBlock AML Research explains what cross-chain transfers are and how to identify them to search for stolen assets.

Criminals actively utilize cross-chain infrastructure to conceal large-scale illegal funds, and traditional tracking methods are no longer able to keep pace with the speed of such operations. However, automated tools for cross-network analysis are once again giving investigators an advantage and radically changing the fight against complex money laundering schemes.

Chain-hopping as a method of crypto laundering

Chain-hopping involves quickly and repeatedly switching assets between different networks or exchanging different assets within a single chain.

The goal is to create a chain of transactions that is virtually impossible to analyze manually, overwhelming investigative resources.

There are three main types of services used for cross-chain money laundering:

1. Decentralized exchanges (DEXs)

These are DeFi protocols that automatically exchange assets on a single blockchain network using smart contracts and liquidity pools.

DEXs do not require intermediaries or identification, so cybercriminals can quickly convert stolen assets into more liquid ones that are easier to launder, such as stable tokens or native blockchain assets. This makes it difficult to freeze funds and complicates the recovery of the data chain.

2. Cross-chain bridges

Bridges transfer value between different blockchains using the lock-and-mint principle. The original asset is locked in a smart contract, and its equivalent is issued on the target network from a reserve pool.

For example, in the CBEX scam, attackers made over a hundred transfers between Tron and Ethereum, making the investigation much harder. Each step like this increases the amount of manual work many times over.

3. Coin swap services

Centralized platforms (sometimes websites or Telegram bots) that allow users to exchange any assets on any network without KYC. Research shows that criminals increasingly prefer coin swap services to mixers.

The use of chain hopping is not in itself a sign of illegal activity — it is a standard mechanism in the crypto ecosystem. Bridges have facilitated billions of dollars in legitimate transfers, and illegal transactions account for less than 1% of the total.

However, this method is actively used to cover up traces of terrorism, circumvent sanctions, Ponzi schemes, gambling services, darknet platforms, and crypto hacks. Research shows that 33% of complex cross-chain investigations now involve more than three blockchains, 27% involve more than five, and 20% involve more than ten.

Criminals often combine several methods: for example, after hacking the Cetus Network for about $200 million, the attackers first exchanged USDT for USDC via DEX, then transferred the funds to Ethereum via a bridge, and then the DEX aggregator exchanged USDC for ETH — probably to avoid freezing the assets.

Clearly, chain-hopping is effective, especially when investigators or compliance specialists do not have automated cross-chain analysis tools. Manually tracking movements through DEXs, bridges, and coin swap services can take months and easily lead to important clues being missed.

Automated cross-chain analysis and end-to-end asset tracking

Traditional cross-chain analysis requires manually matching each transaction through blockchain explorers: determining where assets went, matching transactions, amounts, and timestamps between chains. This approach is excessively slow and resource-intensive.

Modern analytical tools solve the problem automatically by matching source and destination bridge transactions. The Virtual Value Transfer Event (VVTE) system automatically builds connections between transactions and supports hundreds of bridge combinations.

The effect of VVTE for different teams

• Transaction monitoring: gains instant visibility into the origin of funds coming through bridges.
• Compliance and law enforcement professionals: accelerate case building by gathering evidence across complex cross-chain chains.
• Financial institutions: gain transparency into cross-chain activity for accurate risk assessment.

At the same time, traditional analysis of a single asset creates blind spots. For example, if an Ethereum wallet contains dozens of tokens, checking only native ETH does not provide a complete picture of the risks — analysis is required for each asset.

Full coverage of assets and blockchains provides comprehensive risk identification, while end-to-end analysis checks all chains and assets associated with a wallet or transaction in real time.

Modern tools also allow data to be analyzed using natural language — an investigator can ask questions such as “which addresses made large donations” or “which wallets show patterns of gas fee financing,” which speeds up the understanding of big data and the detection of anomalies.

Thanks to comprehensive analytical solutions, investigators turn cross-chain traces into an advantage. Criminals’ attempts to hide funds through chain-hopping create even more data and evidence — every bridge, every transition, and every transaction structure forms permanent traces.

In one of the investigations demonstrated, where funds from a hack were moved across five blockchains and 48 transactions via bridges, automated analysis made it possible to see the entire chain in seconds. It also identified mistakes made by the attackers, such as reusing the same wallet.

Operational requirements for crypto compliance teams

The growth of cross-chain crime from $7 billion to $22 billion in two years is creating new mandatory requirements:

• Implementation of comprehensive multi-chain screening: a single wallet can contain hundreds of tokens on different networks, so the analysis must cover all multi-chain activity.
• Use of automated cross-chain analysis: manual tracking of bridges is not scalable, while the VVTE approach allows large volumes of data to be processed in minutes.
• Extended customer verification, considering on-chain and off-chain data: this allows for the detection of risks that cannot be identified based on transactions alone.
• Risk rule configuration considering cross-chain exposures: even if funds go through several “hops,” contact with sanctioned addresses still creates risks.
• Continuous monitoring of new threats: these include AI-based fraud infrastructure, meme coin schemes, and new laundering methods, including North Korean techniques.

Criminals are constantly improving their methods, and compliance teams must keep pace. Analysis tools, high-quality data, and the ability to conduct large-scale investigations are key factors for effectiveness in the rapidly changing landscape of crypto crime.