Chain-hopping — the practice of moving cryptocurrency across multiple blockchain networks to obscure the origin and destination of funds — has become one of the most common evasion techniques in crypto-enabled crime. What was once a specialist technique used by sophisticated threat actors is now accessible to anyone with a basic understanding of decentralised finance. The tooling is available, the bridges are open, and the process can be completed in minutes.
For investigators, chain-hopping presents a fundamental challenge. Traditional blockchain analysis operates within a single network: tracing transactions on Ethereum, or following the flow of Bitcoin through a series of wallets. But when a criminal moves funds from Ethereum to BNB Chain, then to Polygon, then to Tron — each hop crossing a network boundary — the investigative trail fragments. Most legacy analytics tools were not built for this reality.
Understanding chain-hopping patterns is no longer optional for crypto crime investigators. It is a core competency. This article examines the most common techniques, the indicators that reveal them, and the investigative approaches that can bring cross-chain trails back into focus.
What Is Chain-Hopping?
At its simplest, chain-hopping is the movement of value from one blockchain to another. A criminal holding illicit funds on Ethereum might bridge those funds to BNB Chain, swap them for a different token on a decentralised exchange, bridge again to Avalanche, and finally cash out through a centralised exchange operating in a jurisdiction with weaker KYC requirements.
The core principle behind chain-hopping as an evasion technique is straightforward: by moving funds from one blockchain to another, the trail becomes harder to follow because most analytics tools only cover a single chain at a time. Each hop creates an apparent dead end on one network and a fresh start on another. If an investigator is only looking at Ethereum, the funds appear to vanish when they enter a bridge contract. If they are only looking at BNB Chain, the funds appear from nowhere.
Criminals exploit this fragmentation deliberately. The more hops, the more chains involved, and the more intermediate token swaps performed, the harder it becomes for a single-chain investigation to reconstruct the complete flow of funds.
Common Chain-Hopping Patterns
While the specific routes vary, chain-hopping techniques tend to follow recognisable patterns. Understanding these patterns allows investigators to anticipate the next move and maintain visibility even as funds cross network boundaries.
1. Bridge Hops
The most direct form of chain-hopping involves using cross-chain bridges to move assets from one network to another. A bridge is a protocol that allows users to transfer tokens between blockchains — for example, moving ETH from Ethereum to BNB Chain, or transferring USDT from Ethereum to Tron.
Bridge contracts work by locking tokens on the source chain and minting equivalent tokens on the destination chain (or releasing previously locked tokens). From an investigative perspective, this creates a specific challenge: the transaction on the source chain shows funds flowing into a bridge contract address, and the transaction on the destination chain shows funds appearing from a different bridge contract address. Without cross-chain visibility, these two events appear unrelated.
Criminals favour bridges because they are permissionless (anyone can use them), relatively fast, and create a clear break in the single-chain audit trail. Some bridges also offer additional privacy features, such as delayed withdrawals or batched transactions, that further complicate tracing.
2. Wrapped Token Conversion
Wrapped tokens are representations of an asset from one blockchain on another blockchain. The most well-known example is Wrapped Bitcoin (WBTC), which represents BTC on the Ethereum network. A criminal might convert BTC to WBTC on Ethereum, use it in various DeFi protocols, then unwrap it back to BTC — or bridge the WBTC to yet another chain.
The wrapping and unwrapping process introduces additional complexity for investigators. The original BTC is held in custody by the wrapping protocol, while the WBTC circulates on Ethereum. If the WBTC is subsequently bridged to another chain, the investigator must follow the trail across three layers: the original Bitcoin network, Ethereum, and the destination chain. Each layer has different transaction formats, different explorer tools, and potentially different analytics coverage.
3. DEX Swaps as Intermediate Steps
Decentralised exchanges (DEXs) allow users to swap one token for another without an intermediary. Criminals use DEX swaps as intermediate steps in chain-hopping sequences to change the token type before or after a bridge hop. This adds a layer of obfuscation because the investigator must track not only the movement across chains but also the transformation of the asset from one token to another.
For example, a criminal might receive illicit ETH, swap it for DAI on Uniswap, bridge the DAI to Polygon, swap it for MATIC on QuickSwap, then bridge the MATIC to another chain. Each swap changes the token, and each bridge changes the chain. The combined effect is a trail that is extremely difficult to follow manually.
DEX swaps are particularly challenging because they are executed through smart contracts and recorded in transaction logs (event data) rather than as simple value transfers. Investigators need tooling that can parse these contract interactions and extract the relevant swap details — input token, output token, amounts, and counterparties.
4. Stablecoin Pivot
Stablecoins — tokens pegged to fiat currencies, such as USDT and USDC — are among the most frequently used assets in chain-hopping sequences. Criminals convert volatile cryptocurrencies to stablecoins early in the laundering process for two reasons: stablecoins maintain a consistent value (reducing the risk of loss during the laundering process), and they exist natively on multiple blockchain networks.
USDT, for example, is available on Ethereum, Tron, BNB Chain, Solana, Avalanche, Polygon, and numerous other networks. A criminal can convert illicit funds to USDT on Ethereum, bridge the USDT to Tron (which has lower transaction fees and faster confirmation times), and then cash out through a Tron-based exchange or peer-to-peer service. The stablecoin acts as a universal medium that moves easily across chain boundaries.
Tron has become a particularly favoured destination for stablecoin-based chain-hopping. Its low fees, high throughput, and widespread adoption in certain regions make it an attractive endpoint for criminals seeking to convert crypto to fiat. Investigators who focus solely on Ethereum or Bitcoin may miss significant volumes of illicit activity that has pivoted to Tron via stablecoin bridges.
5. Multi-Hop Layering
The most sophisticated chain-hopping sequences combine multiple techniques in a deliberate layering strategy. A typical multi-hop sequence might involve: receiving illicit funds in ETH on Ethereum, swapping to USDC on a DEX, bridging to Polygon, swapping to MATIC, bridging to Avalanche, swapping to AVAX, bridging to BNB Chain, swapping to BNB, and finally cashing out.
Each hop adds complexity for the investigator. With five or more hops across different chains, involving multiple token swaps at each stage, the total number of transactions involved can reach into the dozens. Manual tracing becomes impractical, and even automated tools struggle unless they maintain cross-chain visibility and can correlate transactions across networks.
Multi-hop layering is often combined with timing variations (introducing delays between hops), amount splitting (dividing funds across multiple paths), and the use of intermediary wallets that are used once and discarded. The result is a laundering pattern that is designed, step by step, to defeat investigation.
Real-World Indicators
Despite the complexity of chain-hopping, certain indicators can alert investigators to its use:
- Funds flowing to known bridge contract addresses. Bridge contracts have identifiable on-chain addresses. Monitoring for interactions with these addresses is one of the most reliable indicators of cross-chain movement.
- Sudden conversion from native tokens to stablecoins. When a wallet that has been holding ETH or BTC suddenly converts its entire balance to USDT or USDC, this can indicate preparation for a cross-chain transfer.
- Activity spikes timed to avoid detection windows. Some criminals time their chain-hopping activity to coincide with periods of high network congestion (when individual transactions are less likely to attract attention) or outside of business hours in the jurisdictions where their target exchanges operate.
- Small "test" transactions before larger movements. Criminals frequently send small amounts through a chain-hopping route before committing larger sums. These test transactions confirm that the bridge is operational and the route is clear. Investigators who spot small-value bridge interactions followed by larger ones through the same path may be observing a laundering operation in progress.
- Use of newly deployed or low-liquidity bridges. More sophisticated actors may use obscure or newly launched bridges that have less analytics coverage. While major bridges like Multichain and Wormhole are well-monitored, smaller or newer protocols may fly under the radar.
Investigative Approaches
Investigating chain-hopping requires tools and techniques that go beyond single-chain analysis. The following approaches are proving effective in practice:
- Multi-chain analytics platforms that maintain cross-chain visibility. The most critical requirement is tooling that can follow funds across network boundaries without losing the trail. This means platforms that index multiple blockchains and maintain mappings between bridge contract interactions on different chains.
- Monitoring bridge contract interactions. By watching for transactions involving known bridge contracts, investigators can identify when funds are leaving one chain and anticipate their arrival on another. This requires maintaining an up-to-date database of bridge contract addresses across all major networks.
- Timing analysis. Cross-chain transfers take time — bridge transactions typically confirm within minutes to hours, depending on the protocol. By correlating the timestamp of a bridge deposit on the source chain with the timestamp of a bridge withdrawal on the destination chain, investigators can link transactions across networks. Timing correlation is especially powerful when combined with amount matching.
- Amount-based correlation. Bridge transfers incur fees, but the amounts are predictable. If an investigator sees 10,000 USDT enter a bridge contract on Ethereum and 9,985 USDT appear from a bridge contract on Tron shortly afterwards, the correlation is strong. Matching values (minus known bridge fees) across chains is a fundamental technique for cross-chain tracing.
- Entity clustering that spans multiple networks. Advanced analytics platforms can cluster addresses across chains based on behavioural patterns, timing correlations, and shared characteristics. This allows investigators to build a picture of an entity's activity across the entire blockchain ecosystem, rather than viewing each chain in isolation.
The Arms Race: Where Chain-Hopping Is Heading
Chain-hopping techniques continue to evolve. Several emerging trends are likely to increase the complexity of cross-chain investigations in the coming years.
Privacy chains such as Monero and Zcash already present significant tracing challenges. As bridges between privacy chains and public chains become more mature, criminals will increasingly use privacy chains as intermediate hops — a "dark" segment in an otherwise traceable flow.
Atomic swaps enable direct peer-to-peer exchanges between blockchains without a bridge intermediary. Because atomic swaps do not rely on a centralised bridge contract, they leave a different on-chain footprint that is harder to monitor at scale.
Account abstraction and smart contract wallets on chains like Ethereum introduce new ways to automate complex transaction sequences. A criminal could deploy a smart contract that automatically executes a multi-hop chain-hopping sequence in response to a single trigger, reducing the window of opportunity for intervention.
ZK-based bridges that use zero-knowledge proofs to validate cross-chain transfers without revealing transaction details are emerging. These bridges offer genuine privacy benefits for legitimate users but also create new challenges for investigators who rely on transparent bridge contract interactions to maintain cross-chain visibility.
The investigative community must adapt continuously. The tools and techniques that work today may be insufficient tomorrow, and maintaining cross-chain investigative capability requires ongoing investment in technology, training, and inter-agency collaboration.
How ShadowTrace Helps
ShadowTrace's multi-chain transaction graph is built specifically to address the challenge of cross-chain investigations. The platform provides automated bridge detection that identifies when funds cross network boundaries, correlates transactions across chains using timing and amount analysis, and presents the complete cross-chain flow in a single unified view. This allows investigators to follow funds through chain-hopping sequences without losing the trail at network boundaries.