At least $21.8 billion in illicit or high-risk crypto has flowed through crosschain swaps, up from $7 billion in 2023, according to estimates by UK-based blockchain analytics firm Elliptic. Elliptic attributes 12% of those movements to North Korea.
Crosschain swaps were once a niche activity reserved for advanced traders and decentralized finance (DeFi) users, but they’ve evolved into a core component of money laundering. Illicit actors no longer simply send crypto through mixers or dump tokens on a single decentralized exchange (DEX). Nowadays, the funds move around multiple blockchains to frustrate investigators and evade detection.
This swift 211% increase, from $7 billion to $21.8 billion, reflects the growing use of blockchain bridges, DEXs and coin swap services, as well as the expanding number of blockchains.
“When you look back, let’s say a decade ago, the primary cryptocurrencies and blockchains out there were Bitcoin and Ethereum and a few others,” Arda Akartuna, Elliptic’s APAC lead crypto threat researcher, told Cointelegraph.
“It’s an increasingly multichain ecosystem... that just widens the available assets and the available obfuscation channels open to criminals.”
Bridges are crosschain laundering highways
A single bridge transaction might reflect ordinary user behavior, but patterns of structured or multi-hop activity are red flags for coordinated efforts to break the onchain trail, Elliptic said in its 2025 crosschain crime report published on Wednesday.
Structured chain-hopping involves splitting funds and distributing them simultaneously across several blockchains. Multi-hop chain-hopping is the act of moving assets from one chain to another repeatedly. Both techniques are inefficient by design, and come with high fees in order to confuse investigators.
These methods are increasingly common in high-stakes laundering operations. In one early 2025 case, hackers suspected to be linked to North Korea stole $75 million from an unnamed exchange and bridged the funds in sequence from Bitcoin to Ethereum, then to Arbitrum, Base and finally Tron — employing both structured and multi-hop tactics.
Related: From Sony to Bybit: How Lazarus Group became crypto’s supervillain
These patterns are no longer limited to state actors or large-scale thefts. In a separate case involving a $200,000 fraud in the UK, the now-convicted culprit split funds across 90 different assets on multiple chains to fund online gambling.
Akartuna explained:
“This isn’t just high-level activity reserved for major hackers. You’ve got smaller-scale criminals using chain hopping to launder funds — people funding gambling habits or petty frauds. That’s how mainstream this tactic has become.”
Elliptic estimates that around a third of blockchain investigations now involve tracing flows across at least three different networks.
Crosschain laundering starts in DeFi
DEXs are often viewed as transparent and traceable as they operate on blockchains. However, they’re increasingly being used as entry points in the crypto laundering cycle, especially when low-liquidity tokens are involved.
DEXs are platforms where such assets can be swapped for more widely accepted tokens like USDt (USDT) or Ether (ETH) without relying on centralized platforms that may enforce Know Your Customer (KYC) rules.
A case study by Elliptic in its 2025 crosschain crime report analyzed the May 2025 exploit on Cetus — a major liquidity provider on the Sui blockchain — that enabled attackers to drain over $200 million in tokens. The attacker initially used a DEX to swap USDT to USDC, which Elliptic suspects was possibly to take advantage of lower bridging costs.
Related: Twice lucky? Cetus’ recovery plan on Sui mirrors a Solana blueprint
These stablecoins were then bridged to Ethereum, where a DEX aggregator was used again to convert the USDC into ETH. Centralized stablecoins like USDt and USDC have functions that allow their issuers to freeze funds. Ether, which is the native asset of the Ethereum blockchain, does not inherently have that functionality.
Criminals also exploit the open design of DEX aggregators and automated market makers (AMMs) to route transactions in ways that reduce slippage and avoid detection. For instance, laundering flows often pass through multiple obscure trading pairs before settling in a liquid token. In many cases, these swaps are performed in small batches or via smart contracts to avoid triggering Anti-Money Laundering (AML) alarms.
Though DEXs are not inherently crosschain, the distinction is becoming less clear in newer services as they also offer native cross-asset swaps, Elliptic said.
Coin swap sites star in crosschain laundering
Coin swap services operate more like underground currency changers. They allow users to anonymously exchange assets across different blockchains with minimal friction, no registration, and often no meaningful Anti-Money Laundering (AML) checks. As a result, these services have become a go-to tool for a wide range of illicit actors, particularly those operating in darknet markets, ransomware networks and online carding fraud.
These platforms are distinct from bridges and DEXs in that they function as centralized intermediaries but deliberately operate in opaque or permissive jurisdictions. Many advertise directly on darknet forums and Telegram channels, often promising to accept “dirty BTC” or emphasizing their non-cooperation with law enforcement.
Some even offer services like armed cash pickups, money counting, or “treasure” cash drops, where physical currency is buried in pre-agreed locations in exchange for crypto.
Elliptic reported that around 25% of illicit and high-risk flows through coin swap services are linked to online gambling, especially platforms lacking mainstream licenses. Many of these sites, particularly those tied to Russian-speaking and Southeast Asian operators, are also connected to scams such as pig butchering and narcotics trafficking, creating a closed loop of high-risk funds being recycled between illicit gambling and laundering networks.
The cat-and-mouse tools chasing crosschain laundering
Chain-hopping, once a fringe tactic, is now routine. Laundering methods that once relied on mixers or simple swaps have evolved into complex sequences that span multiple chains, tokens and platforms — often structured to waste analysts’ time or break automated tracing.
In the $75 million case Elliptic linked to North Korea, the stolen funds were rapidly moved across five different blockchains. Similar patterns are now appearing in smaller fraud cases, indicating that complexity itself has become a deliberate strategy.
Tracing these movements still depends on visibility — and a growing set of tools. Platforms like Elliptic Investigator, Chainalysis Storyline and TRM Forensics are built to automate and visualize crosschain analysis, while centralized stablecoin issuers reserve the ability to freeze flagged assets.
“It doesn’t matter if they’ve tried to do it over five different blockchains or just once — we’re able to follow those funds automatically through our investigation tools. Something that’s really manual and might take several hours, you can now do in mere clicks and minutes because it’s all automated,” said Akartuna.
It’s an uneven match, but the infrastructure for fighting crypto crime is adapting, too.
Magazine: Inside a 30,000 phone bot farm stealing crypto airdrops from real users