Cross-chain tracing

Table of contents

What is cross-chain tracing?

Cross-chain tracing is the process of tracking cryptocurrency as it moves between different blockchains.

Unlike single-chain analysis — which focuses on transactions within a single blockchain network like Bitcoin or Ethereum — cross-chain tracing follows funds as they move through bridges and swap services across multiple blockchains. It combines on-chain analytics with heuristic models, attribution data, and behavioral intelligence to reconstruct multi-chain flows.

Effective cross-chain tracing requires extensive blockchain and asset coverage, as well as bridge and swap service attribution. This enables investigators, compliance teams, regulators, and analysts to connect illicit activity and uncover criminal networks across the crypto ecosystem — rather than providing only a small piece of the picture on a specific blockchain.

‍

How is cross-chain activity evolving?

The crypto ecosystem has expanded from a handful of major blockchains to a diverse, interconnected environment of L1s, L2s, sidechains, and application‑specific networks. As this infrastructure has matured, cross-chain technology — especially bridges, decentralized exchange (DEX) aggregators, and swap protocols — has become a core part of how users move value on chain. This shift has created new opportunities for innovation, but it has also introduced new complexity for teams responsible for detecting and mitigating risk.

At the same time, illicit actors have increasingly adopted cross-chain swaps as part of their operational playbook. Instead of moving funds through a single blockchain — which has historically been “easier” to trace — threat actors now rely on rapid, multi-hop transfers across several networks to create distance between the source of funds and their destination — further obfuscating the money trail.

Many high‑profile ransomware cases, investment fraud schemes, and sanctioned actor typologies in recent years have included multi-chain movement patterns. These tactics are designed to exploit the interoperability of the ecosystem — moving value across multiple assets and blockchains to obscure activity.

This rise in cross-chain activity has changed what “complete” visibility looks like. Investigators and compliance teams can no longer rely on single‑chain tracing to understand risk exposure or the lifecycle of illicit funds. Without insight across chains, key moments — such as when assets pass through bridges or are swapped into new tokens — can mask the true flow of value.

Cross-chain tracing closes these gaps by connecting activity across networks, helping teams build accurate, end‑to‑end narratives and make decisions with confidence.

‍

How does cross-chain tracing work?

Cross-chain tracing involves several core components that work together to provide a complete picture of how assets move across blockchain ecosystems. While each capability is powerful on its own, their true value comes from how they intersect to reveal intent, risk, and actor behavior at scale.

1. Bridge detection

Identifying when and where assets move through cross-chain bridges

Bridge detection is the foundation of cross-chain tracing. Blockchain bridges allow assets to move between networks — for example, wrapping ETH to use on a layer 2 or transferring stablecoins from Ethereum to Solana. Detecting bridge usage involves identifying both the origin and destination of the transfer, as well as recognizing the bridge infrastructure used. This step is critical because many illicit actors rely on bridges to obfuscate flows, evade sanctions detection, or exploit differing compliance standards across ecosystems.

2. Swap analysis

Recognizing when assets are swapped (e.g. ETH to BTC) through bridges and bridge aggregators

Swap analysis adds another layer of complexity. Once funds move across chains, they’re often converted into other tokens using bridges and bridge aggregators. Swap activity may be embedded within bridges or occur separately. Understanding where, when, and how assets are swapped — and which tokens they’re exchanged into — helps uncover risk signals, such as the use of privacy coins, off-ramping behavior, or attempts to break traceability.

3. Flow visualization

Stitching together activity across chains to present a unified asset trail

Flow visualization brings all of these insights together. By combining bridge detection, swap analysis, and entity attribution, blockchain intelligence platforms like TRM can map the full flow of funds — showing where assets originated, how they moved, and where they ended up. This unified, cross-chain view is essential for understanding intent, proving layering or laundering activity, and identifying off-ramp endpoints.

4. Behavioral analytics

Using indicators like timing, transaction size, and common counterparties to identify patterns

Behavioral analytics enhances traceability by identifying suspicious or evasive transaction patterns. For example, if assets are consistently bridged, swapped, and dispersed across wallets within minutes, this may signal an attempt to obfuscate. By analyzing timing, transaction size, counterparty patterns, and velocity, behavioral models can flag anomalous activity even when no known actor is involved — enabling proactive risk detection.

‍

Why is cross-chain tracing important for investigators and compliance teams?

Law enforcement

Enables full-path tracing of stolen or laundered funds across chains
Reduces investigative dead ends caused by bridging or swap activity
Uncovers additional disruption approaches for asset freezes and seizures

Compliance teams at financial institutions, crypto businesses, and VASPs

Enhances transaction monitoring with risk exposure insights — even if funds move across blockchains
Enables detection of obfuscation tactics, such as layering via cross-chain swaps
Supports regulatory obligations around suspicious activity reporting

Regulators and policymakers

Addresses the regulatory blind spot created by decentralized cross-chain infrastructure
Informs policy design around VASPs, DeFi protocols, and non-custodial bridges
Enables supervision of multi-asset flows, especially in the context of travel rule and anti-money laundering (AML) compliance

‍

How TRM powers cross-chain investigations and risk detection

TRM delivers the industry’s most comprehensive cross-chain tracing capabilities — enabling investigators, compliance teams, and regulators to follow digital assets across 50+ blockchains. As threat actors increasingly exploit cross-chain infrastructure, TRM equips teams with the tools to detect, trace, and respond at scale.

Automatic cross-chain tracing in TRM Forensics

Investigators can trace assets across multiple blockchains in a single, unified graph — no manual stitching required. TRM surfaces high-signal insights, including:

End-to-end tracing across over 640 attributed bridges and swap services in a single click
Automatic links to addresses and entities across blockchain networks
Comprehensive view of risk exposure, even when funds move across chains

Cross-chain risk detection in TRM Transaction Monitoring and TRM Wallet Screening

TRM enables compliance teams to detect and act on risk — even when it originates on another chain. With TRM's extensive attribution of 150M+ cross-chain swaps, teams can:

Detect high-risk exposure, even when funds move across blockchains
Receive alerts when funds have high-risk exposure and moved through a cross-chain swap
Improve detection of obfuscation and layering techniques used by illicit actors

Cross-chain insights from TRM’s threat intelligence team

TRM continuously tracks how illicit actors evolve their tactics — including:

Use of cross-chain DEXs, mixers, and privacy bridges
Cross-chain laundering by sanctioned entities and nation-state actors
Emerging obfuscation patterns in scams, fraud, and ransomware schemes

These insights directly enhance TRM’s models and attribution, helping teams stay one step ahead of adversaries.

Built on behavioral intelligence and entity attribution

At the core of TRM’s cross-chain capabilities is a proprietary intelligence framework that connects fragmented activity across chains. TRM:

Identifies actor-linked wallets based on timing, transaction patterns, and reuse
Clusters activity into behavioral profiles, even across distinct ecosystems

This attribution is used to detect cross-chain swaps. With TRM, teams gain more than a view of what happened — they gain clarity on who’s behind it, how it moved, and where it's going next.

‍

Examples of TRM’s cross-chain tracing in action — and resulting enforcement actions

HSI: Farmacy41 takedown

Homeland Security Investigations (HSI) used blockchain intelligence tools to trace narcotics proceeds across multiple chains — eventually leading to the takedown of prominent opioid and fentanyl vendor, Farmacy41. The case led to the forfeiture of over USD 1.5 million and provided a clear example of multi-chain tracing in a real-world criminal case.

US DOJ: Nomad Bridge exploit

In 2022, investigators used blockchain intelligence to trace funds stolen in the USD 190 million Nomad Bridge exploit — a cross-chain attack involving complex laundering techniques including privacy coin swaps, mixers, and off-ramps. The investigation helped identify key actors and led to multiple arrests and an international extradition.

Coinbase and FBI: Violent crime convictions

Coinbase used TRM to trace funds across chains through swaps and peeling chains as part of their investigation into a violent home-invasion crypto theft case. The insights led to the identification of the suspect and supported the Federal Bureau of Investigation (FBI) in building a strong evidence trail.

‍

Frequently asked questions (FAQs)

1. What is cross-chain tracing in crypto investigations?

Cross-chain tracing is the process of tracking digital assets as they move across multiple blockchain networks. It helps investigators follow the complete path of funds — even when assets are bridged, swapped, or moved through complex laundering techniques.

2. Why is cross-chain tracing more complex than single-chain analysis?

Unlike single-chain tracing, which focuses on a single blockchain (e.g. Bitcoin), cross-chain tracing must detect and connect transactions that span many networks. This includes identifying bridges, swap protocols, and other mechanisms used to move and convert assets.

3. How do criminals use cross-chain swaps to evade detection?

Illicit actors use cross-chain swaps to obscure the origin and destination of funds. Rapid, multi-hop transfers — often involving multiple assets and decentralized services — can disrupt the trail, making it harder for investigators to follow the flow of value.

4. What technologies enable cross-chain tracing?

Effective cross-chain tracing relies on a combination of blockchain intelligence, bridge detection, swap analysis, flow visualization, and behavioral analytics. These capabilities work together to reconstruct multi-chain activity and uncover risk patterns.

5. Which blockchain ecosystems are included in cross-chain tracing?

Cross-chain tracing covers a wide range of networks, including layer 1s (e.g. Ethereum, Bitcoin), layer 2s, sidechains, and app-specific chains. TRM supports tracing across 50+ blockchains and hundreds of bridges and swap services.

6. What are bridges and why are they important in tracing?

Bridges are protocols that allow assets to move between blockchains. They’re often used by both legitimate users and illicit actors. Detecting bridge usage is critical to identifying when and where assets leave one network and enter another.

7. How does TRM help with cross-chain investigations?

TRM offers automated cross-chain tracing through TRM Forensics, enabling teams to follow assets across blockchains in a single graph view. It also detects cross-chain risk via TRM Transaction Monitoring and TRM Wallet Screening.

8. Can compliance teams detect cross-chain obfuscation techniques?

Yes. With the right tools, compliance teams can identify high-risk exposure even when funds pass through bridges or swaps. TRM helps detect obfuscation methods like layering, privacy coin usage, and non-custodial swap services.

9. Why does cross-chain tracing matter for regulators?

Cross-chain infrastructure creates visibility gaps for regulatory oversight. Tracing tools like those offered by TRM enable regulators and supervisors to monitor risk across assets, support AML compliance, and inform policy design for DeFi and VASPs.