Cross-Chain Investigations: How Investigators Follow the Money
Chain hopping — bouncing stolen cryptocurrency from one blockchain to another through cross-chain bridges — is the most reliable way launderers break a money trail, and the reason so many investigations stall at the first bridge contract they meet. A cross-chain investigation exists to un-break that trail: follow the value through each bridge crossing, pick it up on the destination chain, and keep going until the funds land somewhere a subpoena can reach.
This guide covers the discipline end to end: what chain hopping is and why it works, how bridges actually move value, how to run a cross-chain investigation step by step, and how cross-chain graphing turns activity on many ledgers into one picture a court can follow.
What Is Chain Hopping?
Chain hopping is a money-laundering technique in which criminals move cryptocurrency across multiple blockchains — usually through cross-chain bridges — to break the transaction trail that any single-chain explorer or analytics tool can follow. Each hop lands the funds on a new ledger with new transaction hashes, a fresh address, and no built-in link back to the chain they left.
The technique works because most tooling is fragmented by design. Public explorers are built for one chain: excellent at showing transactions on that ledger, blind to everything else. The moment a thief bridges funds from Ethereum to Solana, or splits a balance across Tron and Bitcoin, the explorer goes dark. The trail does not actually disappear — it simply continues on a ledger the explorer cannot read.
A typical chain-hopping loop looks like this:
- Funds leave the victim wallet on one chain.
- They pass through a bridge contract that locks or burns the asset and releases an equivalent on a second chain.
- On the destination chain they are split across fresh wallets, swapped into a different asset, and bridged again.
- The cycle repeats until the trail spans several ecosystems.
Each crossing is a clean break for anyone watching one chain at a time. The stakes are not theoretical: after the 2022 Ronin bridge hack — roughly $600 million — the stolen funds were hopped across chains and mixing services for months, a reminder that modern laundering is a cross-chain process from the first hour.
How Does a Cross-Chain Bridge Investigation Actually Work?
Every cross-chain bridge investigation reduces to one task: pairing a deposit on the source chain with its payout on the destination chain. A bridge crossing is not one transaction — it is two, on two different ledgers, with no shared hash between them. The link lives in the bridge's own bookkeeping, and where to find it depends on what kind of bridge you are looking at.
Lock-and-mint bridges
The classic wrapped-asset model. The bridge locks the original token in an escrow contract on the source chain and mints a wrapped equivalent on the destination chain. On-chain, the investigator sees a transfer into a known escrow address, then a mint event on the far side. The deposit event usually records the destination chain, the recipient, and a nonce or deposit ID — the identifiers that make pairing possible.
Burn-and-mint bridges
Used for natively multi-chain assets — Circle's CCTP for USDC is the canonical example. The token is burned on the source chain and minted fresh on the destination, so there is no escrow to watch. The burn event carries the recipient and amount, which makes these crossings the cleanest to pair once you know to read the event rather than the transfer.
Liquidity-network bridges
Protocols such as Across and Hop never mint anything. A relayer fronts the asset from a destination-side liquidity pool, and the protocol settles with the relayer later. These are the hardest crossings to pair by eye: the destination payout comes from a pool address, not from "the bridge," and the amount differs by a relayer fee. The deposit ID in the event data is the reliable link — amounts and timing alone can mislead.
Across all three types, three signals confirm a pairing: the event data (destination chain, recipient, deposit identifier), the amount (source value minus fees), and the timing (payouts usually land within minutes). One caution: the recipient on the destination chain is often not the sending address. Launderers routinely set a fresh recipient on every hop, which is exactly why reading the event data beats guessing by address.
This pairing is what Noxos Intelligence automates. Its Hydra engine recognizes when a trace reaches a bridge, resolves the corresponding transaction on the destination chain, and continues the trace there — in the same graph. Hydra follows value across 17 blockchains — Bitcoin, Solana, Tron, Ethereum, and thirteen additional EVM L1s and L2s — and major cross-chain bridges, stitching each crossing in automatically instead of leaving a dead end. It is the same resolution that lets investigators reconstruct a DeFi exploit from flash loan to cash-out even when the attacker hops chains to launder the proceeds.
How to Run a Cross-Chain Investigation, Step by Step
A cross-chain investigation follows the same skeleton whether it is a $5,000 phishing drain or a nine-figure bridge exploit:
- Fix the seed. Start from what is certain: the victim wallet, the theft transaction, the attacker's first address, and when it happened. Everything downstream inherits its credibility from this anchor, so document it precisely.
- Choose a direction. Trace forward from the theft to see where the funds went. Trace backward from a suspicious deposit to attribute its true source — the standard move for compliance teams clearing an inbound transfer.
- Set the depth. Hop depth controls how many rings outward the trace walks — from 1 to 30 in Noxos. Shallow traces answer quick questions; deep traces map an entire laundering structure. Start shallow, read the graph, then extend where the money actually went.
- Follow every bridge crossing. This is where single-chain work ends and cross-chain work begins. Each crossing should be resolved — deposit paired with payout — not assumed. Hydra does this automatically; whatever tooling you use, verify that amounts and timing corroborate each pairing.
- Read the labels. A graph of anonymous hex strings answers nothing. Match every address against a label library so exchanges, bridges, mixers, and services appear by name — knowing who owns a wallet is the difference between a dead end and a subpoena target. Deterministic risk scores surface the hops worth inspecting first.
- Stop at accountability, then export. The practical goal is a point of accountability: an exchange deposit address, a regulated off-ramp, a service that holds records. When the trail reaches one, compile the trace into a court-admissible investigation report — the graph, the labeled path, and the audit log behind them.
Two properties make the output defensible rather than merely persuasive. Determinism: Noxos traversal and scoring are reproducible, so an opposing expert can rerun the same trace and arrive at the same graph — no hidden randomness to dispute. And chain of custody: every data fetch and every step the engine takes is recorded in an immutable per-case audit log, from seed address to final conclusion.
Cross-Chain Graphing: Turning Many Ledgers into One Picture
Cross-chain graphing is the practice of rendering fund flows from multiple blockchains as a single connected graph — one set of nodes and edges spanning every ledger the money touched. It sounds like a visualization detail. It is actually the core data model of a cross-chain investigation, and it has to solve three problems single-chain graphs never face.
Identity. A node cannot be a bare address; it must be an address anchored to its chain. The same hex string can exist on a dozen EVM networks, sometimes controlled by the same actor and sometimes not. Chain-scoped identity keeps the graph honest — and makes deliberate address reuse across chains visible as a pattern instead of a collision.
Continuity. Bridge crossings become edges. When a crossing is resolved, the source-chain subgraph and the destination-chain subgraph join into one component, and the money reads as a single flow — wallet to bridge to wallet, regardless of how many ledgers that spans. Unresolved crossings stay visibly marked as frontiers rather than silently truncating the trail.
Attribution. Raw graphs sprawl. Labels name the services; entity clustering groups deposit, change, and forwarding wallets under the single actor in control, collapsing what looks like twenty addresses into one adversary. Every node carries a deterministic risk score, so high-risk structure stands out before you inspect a single hop by hand.
The result is a graph that may span many chains, dozens of hops, and hundreds of addresses — and still read at a glance. For briefings and review, Noxos traces can also run in a cinematic fullscreen mode that animates the graph as it expands, useful for spotting structure as it forms, not just for presentations.
Manual vs Automated Cross-Chain Tracing
Plenty of investigators still work bridges by hand: open the source transaction in a public explorer, find the bridge contract, hunt through destination-chain history for a matching payout, copy hashes into a spreadsheet, repeat. It can work. It does not scale, and it rarely survives scrutiny.
| Dimension | Manual tracing | Automated cross-chain tracing |
|---|---|---|
| Time per bridge crossing | Minutes to hours of explorer-hopping | Resolved automatically as the trace runs |
| Continuity | Trail restarts on every new chain | One connected graph across all 17 chains |
| Error surface | Copied hashes, mismatched pairings, missed splits | Deterministic traversal, fixed order, no manual transcription |
| Reproducibility | Screenshots and spreadsheets nobody can re-derive | Same inputs always produce the same graph |
| Evidence output | A slide deck of fragments | Hash-sealed report with a chain-of-custody audit log |
Manually pairing one liquidity-network crossing can eat an hour; a laundering path with a dozen crossings across five chains is a week of error-prone work that a defense expert will pick apart line by line. That gap is why dedicated tooling — not explorer stamina — is the baseline for professional crypto tracing work in 2026.
What Happens When the Trail Hits a Mixer or Instant Exchanger?
Not every hop resolves cleanly. Three obstacles come up constantly in cross-chain investigations, and each has a correct response.
Mixers. A deposit into a mixing service is not the end of the case — it is a documented fact with weight of its own. The deposit is permanent evidence of intent to obscure, timing and amount analysis on the far side can narrow candidate withdrawals, and screening against an on-chain sanctions oracle flags exposure to designated entities. Document the entry, bracket the exit window, and keep tracing the candidates forward.
Instant exchangers. Account-free swap services issue a fresh deposit address per transaction and pay out from their own treasury, so the on-chain link between what went in and what came out is severed by design. The trail terminates at the service — but the service holds the records. A documented deposit plus legal process is the play; your report is the instrument that gets it moving.
Exchange deposit addresses. Landing at a major exchange's one-time deposit address is the good outcome. The exchange knows the account holder. This is the point of accountability every trace is hunting for — the place where an investigator's work hands off to law enforcement and legal process, with the evidence packaged to support a freeze or disclosure request.
Worked Example: Following Stolen Funds Across Three Chains
What follows is an illustrative composite drawn from common casework patterns — not a real case.
A victim signs a malicious approval on Ethereum and loses roughly $180,000 in stablecoins to a drainer wallet. Within an hour, the attacker swaps everything into a single bridgeable stablecoin and splits it across three fresh wallets — a classic peel before the hop.
Overnight, each wallet bridges to Tron through a liquidity-network bridge, in tranches hours apart, each with a different recipient address. On a public explorer, the trail now looks like three unrelated deposits into a bridge contract. This is precisely where manual investigations stall.
A forward trace from the drainer wallet tells a different story. Hydra resolves all three crossings — each deposit paired to its payout through the bridge's event data — and the graph shows the three Tron recipients as one connected component. Two hops later they consolidate into a single wallet. One hop after that, the consolidated balance lands at an address labeled as an exchange deposit.
The graph now reads, on one screen: victim, drainer, three-way split, three bridge crossings, Tron consolidation, exchange deposit. The investigator exports the report — labeled path, risk scores, audit-log appendix — and counsel sends it to the exchange with a preservation request. No outcome is ever guaranteed in asset recovery, but this is the difference between "the money crossed a bridge and vanished" and a named account at a regulated venue, documented to an evidentiary standard, while the funds may still be there.
Start Following the Money
Chain hopping only works while no one can see across the chains. Close that gap and the strategy collapses into what it always was: a longer trail, not a hidden one. Point Noxos at an address, choose forward or backward, set your depth, and let the Hydra engine follow the funds across every bridge and chain they touch — then export a report you can stand behind.
See how a cross-chain trace unfolds in the interactive demo — or, if you are holding a theft case right now, hire a specialist and get an initial review within 24 hours.
FAQ: Cross-Chain Investigations and Chain Hopping
What is chain hopping in crypto laundering?
Chain hopping is a laundering technique where criminals move stolen cryptocurrency across multiple blockchains, usually through cross-chain bridges, to break the transaction trail on any single chain. Each hop produces new transaction hashes on a new ledger, defeating single-chain explorers and analytics tools. The pattern is typically bridge, split, swap, and bridge again until the trail spans several ecosystems. Cross-chain tracing counters it by resolving each bridge crossing and continuing on the destination chain.
Can stolen crypto be traced after it crosses a bridge?
Yes. A bridge crossing leaves permanent records on both chains: a deposit transaction on the source chain and a payout on the destination chain, linked by the bridge's own event data, matching amounts, and timing. Investigators — or automated engines like the Noxos Hydra tracer — pair the two sides and continue the trace on the destination chain. Bridging changes which ledger records the funds; it does not erase the record.
What is a cross-chain investigation?
A cross-chain investigation is a fund-tracing investigation that follows cryptocurrency across every blockchain it touches instead of stopping at the edge of a single ledger. It combines transaction analysis on each chain with bridge resolution to connect them, producing one continuous money trail from the seed address to a point of accountability, such as an exchange deposit, backed by evidence that can support legal process.
What is cross-chain graphing?
Cross-chain graphing is the practice of rendering fund flows from multiple blockchains as one connected graph. Every node is an address anchored to its chain, every edge is a transfer, and resolved bridge crossings become edges that stitch the per-chain subgraphs together. Combined with address labels, deterministic risk scores, and entity clustering, it turns thousands of raw transactions across many ledgers into a single picture an investigator — or a court — can read.
How do investigators trace funds through a cross-chain bridge?
Investigators pair the source-chain deposit with the destination-chain payout using three signals: the bridge's event data, which records the destination chain, recipient, and a deposit identifier; the amount, which matches the deposit minus fees; and timing, since payouts typically land within minutes. Automated tracing engines perform this pairing across major cross-chain bridges and continue the trace on the destination chain within the same graph.