Cryptocurrency transfers are often described as transparent: transactions on public blockchains can be examined. But when assets move from one network to another, there is no longer a single, continuous record. Investigators must compare events across separate systems and determine which ones are connected.
This is the challenge examined in The State of Cross-Chain Crime 2025, a report by blockchain analytics company Elliptic. The company estimated that, by May 2025, more than $21.8 billion in crypto assets classified as illicit or high-risk had moved through cross-chain exchanges. That was roughly three times its estimate for 2023, or $7 billion. The figure includes not only funds whose criminal origin has been established in court, but also assets Elliptic classifies as high-risk. It is best understood as the company’s estimate—not as a confirmed total of stolen funds.
Blockchains operate as separate systems, each with its own transaction records. A cross-chain bridge helps move assets between them. In one common model, a token is locked on the original network and an equivalent asset is made available on the destination network.
A transfer within one blockchain leaves a sequence of records in that network’s shared ledger. A cross-chain transfer, by contrast, may involve events on at least two blockchains, as well as a message or action handled by the bridge. The records can have different identifiers, formats and timestamps. Analysts need to determine whether they are parts of the same transfer rather than unrelated transactions that happen to look similar.
Bridges and exchange services are used for legitimate activity, too. Elliptic estimated that more than $680 billion in assets had been exchanged through bridges, and said that, in its analysis, illicit funds accounted for less than 1% of that amount. This is Elliptic’s estimate, and it refers specifically to bridge activity—not to all cross-chain crypto activity.
Within a blockchain, analysts can see addresses and the movement of assets, but an address does not automatically reveal its owner’s identity. Moving across networks makes the trail harder to interpret: investigators must work out which events correspond to each other, account for asset exchanges, and distinguish actual transfers from the technical representation of assets on another network.
The connection between two events may be strong or weak. If a bridge produces clear technical records, it may be easier to match transfers. If information is incomplete, investigators may have to rely on indirect indicators and seek further evidence. A suspected link between two addresses does not, by itself, prove that the same person controls them or that a transfer was illegal.
In Elliptic’s sample of complex investigations, 33% involved more than three blockchains, 27% involved more than five, and 20% involved more than ten. These figures do not represent all cryptocurrency crime; they refer to cases the company identified as complex cross-chain investigations. Still, they illustrate how investigators may have to piece together transaction histories from many separate networks.
There is also a challenge in calculating amounts. If the same assets pass through several networks, they should not be counted as new funds at every stage. Analysts need to distinguish repeated movements from new deposits and account for how a bridge or exchange service represents assets. Different counting methods can produce different estimates.
In February 2025, crypto assets worth about $1.5 billion were stolen from Bybit. The FBI attributed the theft to the North Korean group TraderTraitor. In its public warning, the bureau said the stolen assets were being moved to thousands of addresses across multiple blockchains. The case shows how one major incident can create a large number of cross-chain leads for investigators to examine.
The value of the stolen assets is not the same as the amount the perpetrators managed to cash out or spend. Between those stages, there may be many transfers, asset freezes, recoveries and interactions with exchanges or other services. The FBI asked companies across the industry—including exchanges, bridges and DeFi services—to block transactions associated with identified addresses. This illustrates that investigations may rely not only on public blockchain records, but also on cooperation from companies operating in the sector.
This is the challenge examined in The State of Cross-Chain Crime 2025, a report by blockchain analytics company Elliptic. The company estimated that, by May 2025, more than $21.8 billion in crypto assets classified as illicit or high-risk had moved through cross-chain exchanges. That was roughly three times its estimate for 2023, or $7 billion. The figure includes not only funds whose criminal origin has been established in court, but also assets Elliptic classifies as high-risk. It is best understood as the company’s estimate—not as a confirmed total of stolen funds.
Blockchains operate as separate systems, each with its own transaction records. A cross-chain bridge helps move assets between them. In one common model, a token is locked on the original network and an equivalent asset is made available on the destination network.
A transfer within one blockchain leaves a sequence of records in that network’s shared ledger. A cross-chain transfer, by contrast, may involve events on at least two blockchains, as well as a message or action handled by the bridge. The records can have different identifiers, formats and timestamps. Analysts need to determine whether they are parts of the same transfer rather than unrelated transactions that happen to look similar.
Bridges and exchange services are used for legitimate activity, too. Elliptic estimated that more than $680 billion in assets had been exchanged through bridges, and said that, in its analysis, illicit funds accounted for less than 1% of that amount. This is Elliptic’s estimate, and it refers specifically to bridge activity—not to all cross-chain crypto activity.
Within a blockchain, analysts can see addresses and the movement of assets, but an address does not automatically reveal its owner’s identity. Moving across networks makes the trail harder to interpret: investigators must work out which events correspond to each other, account for asset exchanges, and distinguish actual transfers from the technical representation of assets on another network.
The connection between two events may be strong or weak. If a bridge produces clear technical records, it may be easier to match transfers. If information is incomplete, investigators may have to rely on indirect indicators and seek further evidence. A suspected link between two addresses does not, by itself, prove that the same person controls them or that a transfer was illegal.
In Elliptic’s sample of complex investigations, 33% involved more than three blockchains, 27% involved more than five, and 20% involved more than ten. These figures do not represent all cryptocurrency crime; they refer to cases the company identified as complex cross-chain investigations. Still, they illustrate how investigators may have to piece together transaction histories from many separate networks.
There is also a challenge in calculating amounts. If the same assets pass through several networks, they should not be counted as new funds at every stage. Analysts need to distinguish repeated movements from new deposits and account for how a bridge or exchange service represents assets. Different counting methods can produce different estimates.
In February 2025, crypto assets worth about $1.5 billion were stolen from Bybit. The FBI attributed the theft to the North Korean group TraderTraitor. In its public warning, the bureau said the stolen assets were being moved to thousands of addresses across multiple blockchains. The case shows how one major incident can create a large number of cross-chain leads for investigators to examine.
The value of the stolen assets is not the same as the amount the perpetrators managed to cash out or spend. Between those stages, there may be many transfers, asset freezes, recoveries and interactions with exchanges or other services. The FBI asked companies across the industry—including exchanges, bridges and DeFi services—to block transactions associated with identified addresses. This illustrates that investigations may rely not only on public blockchain records, but also on cooperation from companies operating in the sector.