Chain-hopping as an obfuscation and laundering pattern

Stolen and criminal funds now cross several blockchains within hours, and each crossing moves the evidence to a different ledger, often to a different record holder in a different country. For an investigator, chain-hopping is above all a contest of time: every hop adds a matching problem, a new set of records to preserve and a new link whose strength must be stated. Knowing the usual patterns lets you anticipate the next hop, send preservation requests before records expire and say precisely where the trail is proven and where it is inferred.

Why criminals hop

Chain-hopping is the movement of value across blockchains or asset types, through bridges, swaps or exchange services, with the effect (and often the purpose) of making a trail harder to follow. The IDFE-BA lesson Cross-chain tracing explains the mechanics; here the question is what each hop does to an investigation. Offenders hop for several reasons, usually at once:

• To break the graph. Two ledgers share no transaction edge. Every crossing forces the investigator to establish a link that a single-chain tool will not draw automatically, and some tools cover only certain chains and bridges.
• To leave freezable assets. Stablecoin issuers can freeze tokens at an address (see the lesson Freezing and seizure options), so thieves holding stablecoins often swap them for a native asset within minutes. The reverse also happens: funds are converted into stablecoins on a low-fee chain just before cash-out, because that is where brokers and buyers are.
• To reach liquidity and exits. Large amounts need deep markets, and cash-out venues (OTC brokers, peer-to-peer sellers, exchanges with weak controls) favor particular chains and assets.
• To fragment jurisdiction. A trail that touches a bridge front end in one country, an instant-exchange service in a second and an exchange in a third needs three sets of legal requests, each with its own delay (see the lesson Legal authority and international cooperation).
• To reach privacy systems. Some hops end in a privacy coin or a mixer, covered in module 4.

Hopping is not in itself evidence of crime. Ordinary users bridge to save fees or chase yields. The FATF report Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing (September 2020) treats as red flags transactions that use more than one type of virtual asset despite extra fees, and large conversions between asset types with no logical business explanation. The indicator is the combination: speed, cost, no economic purpose and a criminal source.

Typical sequences

Public cases show recurring shapes. After the March 2022 theft from the Ronin bridge, a public analysis by a security firm described stolen ETH moving through a smart-contract mixer, then being swapped on decentralized exchanges for a bitcoin-pegged token, bridged to the Bitcoin network and unwrapped into BTC, before part of it went through custodial bitcoin mixers. After the February 2025 theft of about $1.5 billion from the Bybit exchange, the victim's own update of March 4, 2025 reported that about 72% of the stolen funds had passed through the THORChain cross-chain swap protocol and that roughly 83% of the stolen ether had been converted to bitcoin.

A generic laundering sequence for a theft or scam looks like this:

The evidential gap at each hop

Each kind of hop leaves a different gap between "funds left here" and "funds arrived there". The gap decides what you can claim from on-chain data alone and whose records you need.

Four practical consequences follow. First, a path takes the grade of its weakest link (see the lesson Tracing to an evidential standard): a link verified on both chains is grade A (including a cross-chain swap whose inbound and outbound memos name each other), a pairing that rests on a protocol's or operator's off-chain records is B once checked against both chains, and an amount-time match is an inference, grade D, until records confirm it. Second, a hop through a custodial service ends the on-chain trail on the deposit side, as explained in the lesson Tracing through custodial services; what comes out is a new trail that must be linked by records or by explicit inference. Third, where the destination address is written into the source transaction (a bridge recipient field, a swap memo), the link does not depend on matching at all: read the source event before searching the destination chain. Fourth, record the asset change at every hop, with the rate and the price source, because amounts change form as well as ledger.

Time and amount windows

When no identifier connects two sides, you must search the destination chain for candidates, and the search window must come from the mechanism, not from habit.

Time windows. Use the real delay of each mechanism: seconds to a few minutes for a relayer fill, minutes for a bridge that waits for source-chain finality, about a week for a canonical withdrawal from an optimistic rollup, and minutes to hours for an instant-exchange service, depending on its confirmation policy and queue. Convert every timestamp to UTC, record block heights on both chains and allow for clock differences in services' own records.

Amount windows. Expected output equals input times the exchange rate, minus the service fee, minus network fees on both sides. Compute an expected range rather than a point: the rate at the time of the deposit and at the time of the payout can differ, and some services quote a fixed rate for a short period. Record the price source and the time of each quote you use.

Defend the window. Before running the search, write down the window and the band and why you chose them. Afterwards, test sensitivity by widening and narrowing both, and measure how often a random deposit of similar size would find a candidate by chance (the chance-match rate in the IDFE-BA lesson Cross-chain tracing). A match found only after the window was adjusted to fit is worth little in front of a court.

Recording every hop

Each hop deserves one structured record in the case file, kept with the working notes and hashed with the other exhibits (see the lesson Hashing, logging and chain of custody). A fictional example:

{
  "hop_id": "H-04",
  "type": "bridge_liquidity_fill",
  "source": {"chain_id": 1, "txid": "0x5e2a…c71d", "log_index": 212,
             "block": 25466930, "block_hash": "0x8b41…e02f",
             "time_utc": "2026-06-16T02:58:11Z", "asset": "ETH",
             "amount_wei": "600000000000000000000"},
  "destination": {"chain_id": 42161, "txid": "0x91bf…04ae", "log_index": 7,
                  "block": 483120877, "block_hash": "0x2d7c…91a4",
                  "time_utc": "2026-06-16T02:58:47Z", "asset": "ETH",
                  "amount_wei": "599640000000000000000"},
  "link_key": {"origin_chain_id": 1, "deposit_id": "1840221"},
  "grades": {"flow": "A", "basis": "shared key verified on both chains"},
  "fee_explained": "0.36 ETH relayer fee quoted in deposit event",
  "sources": ["own archive node (ETH)", "provider RPC (ARB), checked on explorer"],
  "records_to_request": ["bridge front end: API and IP logs, depositor address"],
  "examiner": "EX-07", "recorded_utc": "2026-06-16T09:40:00Z"
}

The record names both sides with chain ID, transaction hash, log index, block height and hash, UTC time, asset and amount in integer base units, following the hop record in the lesson Tracing to an evidential standard; the key that links them; the grade and its basis; an explanation of the amount difference; where the data came from; and what records could confirm or extend the hop. An unexplained amount difference or a missing data source is a weakness the defense will find, so the record forces you to address both at the time.

Working against the clock

Because offenders move in hours and legal process takes days, the investigative plan for a multi-chain case runs in parallel. Map the hops already visible, decide for each one who may hold records, and send preservation requests to all of them at once rather than one after another (see the lesson Working with service providers). Keep watching the unmoved balances: a dormant address on one chain may be the next hop tomorrow. And separate the hops that are proven from those that are inferred in every interim briefing, because early briefings are often what is later disclosed.

Exam focus: why offenders hop (break the graph, leave freezable assets, reach liquidity, fragment jurisdiction, reach privacy systems) and why a hop alone is not evidence of crime; the FATF 2020 red flags on multiple asset types and conversions without business purpose; typical laundering sequences and the Ronin and Bybit patterns as context; the basis of the link for each hop type and who may hold records; that a path is only as strong as its weakest link and custodial hops end the on-chain trail; setting time and amount windows from the mechanism and fees, and testing sensitivity and chance matches; what a hop record must contain.