At least $ 21.8 billion in illicit or high risk crypto flowed through Crosschain swaps, from $ 7 billion in 2023, according to Blockchain -based firm -based firm estimates Elliptic. Elliptic properties 12% of North Korean movements.
Crosschain swaps are once a niche activity reserved for advanced merchants and decentralized financial users (DEFI), but they have changed to a major monetary laundering element. The prohibited actors no longer simply send crypto through mixers or dump tokens in a single decentralized exchange (DEX). Today, funds are moving around many blockchains to fail investigators and avoid discovering.
The fast 211% increase, from $ 7 billion to $ 21.8 billion, reflects the growing use of blockchain bridges, Dex and coin services, as well as expanding the number of blockchains.
“When you look at it, let’s say a decade ago, the main cryptocurrencies and blockchain have bitcoin and Ethereum and some others,” Arda Akaturna, APAC lead crypto Elliptic, Cointelegraph said.
“This is an increasingly multichein ecosystem … which only expands the available properties and the available obfuscation channels that are open to criminals.”
Bridges are crosschain laundering lanes
A single bridge transaction may reflect the user’s ordinary behavior, but patterns of structured or multi-hop activity are red flags for coordinated efforts to break the onchain trail, Elliptic told its its 2025 Crime Crime Report Published on Wednesday.
The structured chain-hopping involves dividing the funds and distributing them simultaneously into several blockchains. Multi-hop chain-hopping is the gesture of moving properties from one chain to another repeated. Both methods are ineffective by designand come with high fee to Interpret the investigators.
These procedures are especially common in high -stake operations. In an early 2025 case, hackers suspected to be linked to North Korea stole $ 75 million from an unnamed replace and killed funds in order from Bitcoin to Ethereum, then to Arbitrum, base and finally tron-use both outlined and multi-hop tactics.
Related: From Sony to Bybit: How the Lazarus Group became supervillain
These patterns are no longer limited to state actors or large robbery. In a separate case involving a $ 200,000 fraud in the UK, the now-convicted Culprit split funds throughout 90 different ownership in many chains to fund online gambling.
Akaturna explained:
“It’s not just a high-level activity reserved for major hackers. You have smaller criminals who use chain hopping on launder funds-people who fund gambling habits or small fraud. That’s how this tactic has become a major tactic.”
Elliptic estimates that around a third of blockchain investigations now involves monitoring the flows of at least three different networks.
Crosschain laundering begins with defi
Dexs are often viewed as transparent and traceable as they operate on blockchains. However, they are especially used as points of entry into the crypto laundering cycle, especially if low-liquid tokens are involved.
Dexs are platforms where such property can be replaced for greater accepted tokens such as USDT (USDT) or ether (Eth) without relying on centralized platforms that may Your customer’s policies (KYC) will be implemented.
A study of Elliptic’s case in his 2025 Crosschain Crime Report examined the May 2025 exploitation of the Cetus – a major liquidity provider at the SUI Blockchain – which enabled attacks to drink more than $ 200 million in tokens. The attack first used a DEX to change USDT to the USDC, in which elliptic suspects could possibly take advantage of lower bridging costs.
Related: Twice as lucky? Cetus’s recovery plan in Sui reflects a Solana’s blueprint
These stablecoins were then bridged to the Ethereum, where a Dex aggregator was used again to convert the USDC to ETH. Centralized stablecoins such as USDT and USDC have operators that allow them those who gave to the funding of funds. Ether, which is the native owner of the Ethereum blockchain, does not naturally have that function.
Criminals are also taking advantage of the open design of DEX aggregators and automatic market makers (AMM) to enact transactions in ways that reduce slippage and prevent discovery. For example, laundering flow often passes through many non -hidden trade pairs before organizing a liquid token. In many cases, these swaps are carried out in small batches or through smart contracts to prevent triggering of anti-money laundering (AML) alarms.
Although Dexs are not natural crosschain, the difference is becoming more pronounced in newer services as they also offer native cross-asset swaps, Elliptic said.
Coin Swap Site Star in Crosschain Laundering
Coin swap services operate like those who change under the money. They allow users who do not identify the exchange of properties with various blockchains with minimal friction, without registration, and often without significant anti-money laundering (AML) checks. As a result, these services have become a go-to tool for a wide range of forbidden actors, especially those operating in Darknet markets, ransomware networks and online carding fraud.
These platforms differ from bridges and dexs that they work as centralized mediators but deliberately operate in fuzzy or permitted constituents. Many have announced directly to DarkNet forums and telegram channels, which often promises to accept “dirty BTC” or emphasize their not cooperation in law enforcement.
Some also offer services such as armed cash pickups, money counting, or “wealth” cash drops, where physical currency is buried in pre-agreed locations in exchange for crypto.
Elliptic reported that around 25% of illicit and high risk flow through coin replacement services were linked to online gambling, especially platforms that lack the basic licenses. Many of these sites, especially those tied to the Russian and Southeast Asian speakers, are also connected to scam like pig butchering and narcotics trafficking, which creates a closed loop of high risk funds recycled between illicit gambling and laundering networks.
Cat-and-mouse tools chasing Crosschain’s laundering
Chain-hopping, once a fringe tactic, is now routine. Launching methods that sometimes rely on mixers or simple swaps have emerged in complex condolences -next to many chains, tokens and platforms -often structured to waste analyst time or break automatic monitoring.
With the $ 75 million elliptic case linked to North Korea, the funds moved to five blockchains quickly. Similar patterns show on smaller frauds as well, suggesting that complexity itself has become an approach.
Monitoring these movements still depends on visibility – and a growing range of tools. Platforms such as elliptic investigator, chainalysis storyline and TRM forensics have been developed to automate and describe crosschain analysis, while centralized stablecoin issues have reserved the ability to frequented the folk assets.
“It doesn’t matter if they try to do this with more than five different blockchains or just once -we automatically follow those funds through our investigation tools. Something that really manufactures and can take a lot of time, you can now do it in clicks and just minutes because it’s all automatic,” Akaturna said.
This is an uneven match, but the infrastructure for fighting the crypto crime is also fitting.
Magazine: Within 30,000 phone bot farm stole crypto airdrops from real users
