According to estimates by the blockchain company Analytics UK Blockchain Elliptical Analytics, at least $ 21.8 billion of $ 21.8 billion in illegal or high -risk crypto crossed crosschain exchanges, compared to $ 7 billion in 2023. Elliptical attributes 12% of these movements in North Korea.
Crosschain exchanges were once a niche activity reserved for advanced traders and decentralized finance users (DEFI), but they have evolved into a central component of money laundering. The illicit actors no longer send crypto via mixers or discharge tokens on a single decentralized exchange (DEX). Nowadays, the funds move around several blockchains to frustrate the investigators and escape detection.
This rapid increase of 211%, from $ 7 billion to 21.8 billion dollars, reflects the growing use of blockchain, Dexs and Swaps bridge services, as well as the expansion number of blockchains.
“When you look back, let’s say a decade ago, the main cryptocurrencies and blockchains there were Bitcoin and Ethereum and a few others,” said Elliptic’s principal of Apac cryptography.
“It is an increasingly multi-dog ecosystem … which simply widens the available assets and the obscure channels available to criminals.”
Bridges are cross bleeding highways
A single bridge transaction could reflect the ordinary behavior of users, but the structured or multi-hop activity models are red flags for coordinated efforts to break the ONCHAIN path, Elliptic said in its Crosschain 2025 crime report published on Wednesday.
The structured chain of the chain involves dividing the funds and distributing them simultaneously on several blockchains. The multi-hop chain is the act of moving assets from one chain to another on several occasions. The two techniques are ineffective by design and are delivered with high costs to confuse the investigators.
These methods are increasingly common in bleaching operations with high issues. In one case at the beginning of 2025, hackers suspected of being linked to North Korea stole $ 75 million in an anonymous exchange and reduced the Bitcoin sequence funds in Ethereum, then to the arbitrum, at the base and finally Tron – using structured and multiple tactics.
In relation: From Sony to Bybit: How Lazarus Group has become the Crypto Supervillain
These models are no longer limited to state players or large -scale flights. In a separate case involving a fraud of $ 200,000 in the United Kingdom, the now convicted culprit shared funds on 90 different active ingredients on several channels to finance the online game.
Akartuna explained:
“It is not only a high -level activity reserved for the main pirates.
Elliptical believes that around a third of blockchain surveys now involve tracing flows on at least three different networks.
Cross bleeding begins to define
Dex are often considered transparent and traceable because they operate on blockchains. However, they are increasingly used as entry points into the cryptography laundering cycle, especially when low liquidity tokens are involved.
DEX are platforms where these assets can be exchanged for tokens more widely accepted such as USDT (USDT) or Ether (ETH) without relying on centralized platforms which can apply the rules of your customer (KYC).
A study of Elliptic cases in its report on crime crossed in 2025 analyzed the feat of May 2025 on Cetus – a large supplier of liquidity on the Blockchain Sui – which allowed the attackers to drain more than $ 200 million in token. The attacker initially used a DEX to exchange USDT to the USDC, which elliptical suspects may have to benefit from the lower bridging costs.
In relation: Twice lucky? The recovery plan of Cetus sur Su follow reflects a solana plan
These stablecoins were then sanded in Ethereum, where a DEX aggregator was used again to convert the USDC to ETH. Centralized stables like USDT and USDC have functions that allow their issuers to freeze funds. The ether, which is the native asset of the Ethereum blockchain, does not intrinsically this functionality.
Criminals also use the open design of DEX aggregators and automated merchants (MA) to transport transactions to reduce slip and avoid detection. For example, laundering flows often go through several obscure trading pairs before settling in a liquid token. In many cases, these swaps are carried out in small lots or via smart contracts to avoid triggering anti-flowage alarms (AML).
Although Dex are not intrinsically crossed, the distinction becomes less clear in more recent services because they also offer native crossing, Elliptic said.
Currency exchange sites featured in croschain whitening
The parts exchange services work more like underground currency changers. They allow users to exchange assets anonymously on different blockchains with a minimum of friction, no inscription and often no significant checks for anti-delated money laundering (AML). Consequently, these services have become an essential tool for a wide range of illicit players, in particular those operating on the Darknet markets, ransomware networks and online fraud.
These platforms are distinct from bridges and Dex in that they work as centralized intermediaries but deliberately operate in opaque or permissive jurisdictions. Many advertise directly on the Darknet forums and telegram channels, often promising to accept “Dirty BTC” or to highlight their non-cooperation with the police.
Some even offer services such as armed vans, silver accounts or “Treasury” cash drops, where physical currency is buried in pre-aged places in exchange for crypto.
Elliptic indicated that around 25% of illicit and high -risk flows in parts exchange services are linked to online games, in particular platforms without consumer licenses. Many of these sites, in particular those linked to Russian operators and Southeast Asia, are also linked to scams such as pig butcher’s shop and drug trafficking, creating a closed high risk loop between the networks of illicit games and bleaching.
Cat and mouse tools chasing the crossing of the crosspiece
The chain, once a marginal tactic, is now a routine. The laundering methods that once rested on mixers or simple swaps have evolved into complex sequences that extend on several channels, tokens and platforms – often structured to waste time or break the automated tracing.
In the elliptical case of $ 75 million linked to North Korea, the funds crossed five blockchains in rapid estate. Similar models also appear in smaller frauds, which suggests that complexity itself has become the strategy.
The tracing of these movements always depends on visibility – and an increasing set of tools. Platforms such as the elliptical investigator, the analysis chain scenario and the TRM criminalic is designed to automate and visualize cross-analysis, while centralized stablecoin transmitters reserve the possibility of freezing the reported assets.
“It doesn’t matter if they’ve tried to do it on five different blockchains or only one time – we can follow these funds automatically thanks to our survey tools. Something that is really manual and can take several hours, you can now do it in a single click and a few minutes because everything is automated,” said Akartuna.
It is an unequal match, but the infrastructure to combat cryptographic crime also adapts.
Review: Inside a 30,000 phones farm, stealing crypto Airdrops to real users
