In 2023, a victim lost 4.2 BTC in a pig butchering scam — roughly $180,000 at the time. The scammer's Bitcoin address was identified within hours. A freeze request was sent to Binance, where the funds were headed. But the Bitcoin never arrived at Binance. Instead, it went through Thorchain, became Ethereum, passed through Stargate to BNB Chain, then through Synapse Protocol to Solana, and finally landed on a decentralized exchange where it was swapped for USDC and withdrawn to an unknown wallet. Six chains. Four bridges. Five hours. By the time the tracing was complete, the funds were gone.

This is chainhopping — the practice of moving stolen cryptocurrency across multiple blockchains via cross-chain bridges to break the forensic trail. It is the single biggest challenge in crypto recovery today. Single-chain tracing, where you follow transactions on one blockchain, is relatively straightforward: every transaction is public, every address can be monitored, and tools like Chainalysis and TRM Labs can visualize the flow of funds. But when funds cross from one blockchain to another, the trail breaks. The Bitcoin address you were tracking disappears. A new address appears on a different blockchain, with no obvious connection to the original.

As a crypto compliance counsel handling fraud recovery cases, I deal with chainhopping in the majority of my cases. This article explains how chainhopping works, which bridges scammers prefer, the technical challenges of cross-chain tracing, and the forensic methods we use to follow funds across blockchains.

What is chainhopping?

Chainhopping is the process of moving cryptocurrency from one blockchain to another using cross-chain bridges or swap services. A user sends Bitcoin to a bridge contract; the bridge locks the Bitcoin on the Bitcoin blockchain and issues a corresponding amount of wrapped Bitcoin (or another token) on a different blockchain, such as Ethereum. The user now has an equivalent asset on Ethereum that they can use, trade, or further bridge to another chain.

For legitimate users, bridges are a convenience — they allow you to use Bitcoin in Ethereum DeFi protocols without selling it. For criminals, bridges are an obfuscation tool. Each time funds cross a bridge, the forensic trail is interrupted. The destination address on the new chain has no direct cryptographic link to the source address on the original chain. To trace through the bridge, an analyst must identify the specific bridge transaction, match the amounts and timing, and confirm that the destination address belongs to the same person.

When a scammer uses multiple bridges in sequence — Bitcoin to Ethereum via Thorchain, then Ethereum to Solana via Wormhole, then Solana to Tron via deBridge — the tracing becomes exponentially more difficult. Each hop introduces a new address, a new blockchain, and a new set of transactions to analyze. The scammer banks on the tracer giving up.

Why scammers prefer cross-chain bridges

The logic is simple: law enforcement and blockchain analytics tools are optimized for single-chain tracing. Chainalysis, TRM Labs, and Elliptic are excellent at visualizing the flow of funds within a single blockchain. They can trace Bitcoin from address to address, identify clusters of addresses controlled by the same entity, and flag transactions involving known illicit services. But when funds cross a bridge, these tools often lose the trail.

This is not a limitation of the tools themselves — Chainalysis and TRM both support cross-chain tracing to some degree. The problem is that bridge transactions are inherently more complex to trace. A bridge does not simply transfer funds from address A to address B. It locks funds on one chain and mints new tokens on another. The connection between the lock transaction and the mint transaction is not recorded on either blockchain — it is an off-chain event managed by the bridge's validator set.

For Thorchain, which is a decentralized bridge, the connection between the inbound Bitcoin transaction and the outbound Ethereum transaction is recorded in the Thorchain blockchain. An analyst who knows to check the Thorchain blockchain can find the link. But for centralized bridges or swap services like Changelly or FixedFloat, the connection exists only in the service's internal database — and accessing it requires a legal request.

Scammers exploit this gap. They choose bridges that are difficult to trace automatically, they move quickly through multiple hops, and they time their transactions to coincide with periods of high network activity when bridge transactions are harder to isolate. The goal is not to make tracing impossible — nothing on a public blockchain is truly untraceable — but to make it slow enough that the funds are cashed out before the tracer catches up.

The bridges scammers prefer

Not all bridges are equally attractive to criminals. Based on the cases I have handled, scammers show clear preferences:

The choice of bridge depends on the scammer's technical sophistication and the specific funds being moved. Low-level scammers often use Changelly or FixedFloat because they are simple and do not require a wallet on multiple chains. More sophisticated operators prefer Thorchain and Stargate because they are decentralized and do not require KYC.

The technical challenge of cross-chain tracing

Single-chain tracing is straightforward. If a scammer steals Bitcoin and sends it to address A, which sends it to address B, which sends it to address C, an analyst can follow the chain of transactions on the Bitcoin blockchain. Each transaction is linked to the next by the input-output relationship. Tools like Chainalysis visualize this as a graph, showing the flow of funds from the source to the final destination.

Cross-chain tracing breaks this model. When funds leave Bitcoin via Thorchain, the Bitcoin transaction shows a send to a Thorchain vault address. On the Ethereum side, a new transaction shows funds arriving at an address from the Thorchain router contract. There is no direct on-chain link between the Bitcoin send and the Ethereum receive — they are separate transactions on separate blockchains. The only way to connect them is to identify the Thorchain transaction that links the two.

This is where specialized knowledge becomes critical. A forensic analyst who knows Thorchain's architecture can:

This process works, but it is manual and time-consuming. For each bridge hop, the analyst must switch tools, switch blockchains, and switch mental models. A single chainhopping case with four bridge hops might require work across six different blockchains, using six different explorers, and manually correlating transactions by amount, timing, and behavioral patterns.

The time factor is critical. In one case I handled, the scammer performed four bridge hops in under three hours. By the time we completed the first hop trace (Thorchain, Bitcoin to Ethereum), the funds had already passed through two more bridges and were on Solana. We were always one step behind. The funds reached a decentralized exchange on Solana and were swapped for USDC before we could coordinate a freeze.

How we trace through bridges

Despite the challenges, cross-chain tracing is not impossible. It requires a combination of technical analysis, behavioral profiling, and legal tools. Here is the methodology we use at Valken:

Step 1: Identify the bridge

When funds leave the original blockchain, we identify which bridge or swap service was used. This is done by checking the destination address of the outgoing transaction. If the funds were sent to a known Thorchain vault address, we know to look at the Thorchain blockchain. If they were sent to a Changelly deposit address, we know to file a legal request with Changelly.

Each bridge has known vault addresses that are publicly identifiable. We maintain a database of these addresses, categorized by bridge and blockchain. When we see funds going to a vault address, we immediately know which bridge was used and where to look next.

Step 2: Match the outbound transaction

Once we know which bridge was used, we search for the corresponding outbound transaction. For decentralized bridges like Thorchain, this involves querying the bridge's own blockchain or API. For Thorchain, we use the RUNE node API to search for outbound transactions that match the inbound transaction's amount and timing.

The matching is not always exact. Bridges charge fees, so the outbound amount is slightly less than the inbound amount. Slippage on swaps can also affect the amount. We search for transactions within a reasonable range (typically within 1-2% of the expected amount) and within a time window (usually 10-60 minutes after the inbound transaction).

For centralized services like Changelly, we cannot query the service's internal database directly. Instead, we file a legal request (a Norwich Pharmacal order or a law enforcement request) asking the service to disclose the destination address, IP, and KYC associated with the swap.

Step 3: Continue tracing on the destination chain

Once we have the destination address on the new chain, we switch to that chain's explorer and analytics tools and continue tracing. If the funds are sent to another bridge, we repeat the process. In complex cases, we may need to trace through four or five bridge hops.

Each hop takes time. Decentralized bridges can be traced relatively quickly (30 minutes to 2 hours per hop) if the analyst is experienced with the bridge's architecture. Centralized services take longer because we need to wait for the legal response (7-14 days for Changelly, 10-25 days for FixedFloat).

Step 4: Identify the cash-out point

The goal of tracing is to identify where the scammer intends to cash out. Scammers cannot spend cryptocurrency directly — they need to convert it to fiat currency at some point. This conversion happens at an exchange (Binance, Kraken, Coinbase, etc.), at a peer-to-peer platform (Paxful, Bisq), or at a fiat off-ramp service.

If we can identify the exchange where the funds are headed before they arrive, we can send a pre-emptive freeze request. This is the single most effective recovery method in chainhopping cases. If the freeze arrives before the funds, the exchange will flag the incoming transaction and hold the funds.

Behavioral patterns in chainhopping

Scammers are not random in their bridge choices. Over hundreds of cases, we have identified behavioral patterns that help us predict where funds are headed, even when we cannot trace every hop in real time:

These patterns are not laws — scammers do adapt and change their methods — but they are reliable enough to guide our tracing strategy. When we lose the trail at a bridge hop, we use these patterns to predict where the funds are likely to appear next and proactively alert the relevant exchanges.

Case study: tracing through three bridges

In a recent case, a client lost 6.8 ETH ($22,000) in a phishing scam. The scammer's Ethereum address was identified immediately. Within 15 minutes, the funds were sent to Thorchain. We traced through Thorchain to Solana (via Wormhole, which Thorchain routed through internally). On Solana, the funds were swapped for USDC on Jupiter DEX. The USDC was then bridged to Tron via deBridge. On Tron, the USDC was sent to a Binance deposit address.

The total tracing time was 4 hours and 20 minutes. We identified the Binance deposit address 2 hours before the funds arrived. We sent a pre-emptive freeze request to Binance with the deposit address and the chain of transactions. When the USDT arrived at Binance, it was frozen automatically. The client recovered 85% of the stolen funds (the 15% loss was from bridge fees, swap slippage, and DEX fees).

This case illustrates that chainhopping, while challenging, is traceable. The key was speed: we identified the bridge pattern early, predicted the likely destination chain (Tron, based on the USDC convergence pattern), and acted before the funds arrived at the exchange. If we had waited to trace each hop sequentially, the funds would have been cashed out at Binance before we could act.

Legal tools for cross-chain recovery

Tracing is only half the battle. Once we identify where the funds are, we need legal tools to freeze and recover them. The legal tools available depend on where the funds end up:

The combination of tracing and legal tools is what makes recovery possible. Tracing without legal action is academic — you know where the funds are, but you cannot touch them. Legal action without tracing is blind — you know you have been scammed, but you cannot tell the exchange which account to freeze. Our practice combines both: we trace the funds across chains and simultaneously prepare the legal instruments needed to freeze them at the destination.

The future of cross-chain tracing

The arms race between scammers and tracers is ongoing. On the scammer side, new tools are emerging: cross-chain mixers that combine funds from multiple users across multiple chains, making it harder to trace individual transactions. Privacy-focused bridges that use zero-knowledge proofs to obscure the connection between source and destination. And AI-assisted routing that automatically selects the most obscure path across multiple bridges.

On the tracing side, tools are improving. Chainalysis has introduced cross-chain tracing capabilities that can follow funds through major bridges automatically. TRM Labs has a similar feature. The FBI's cryptocurrency forensic unit is investing in cross-chain tracing tools. And regulatory changes — particularly the EU's MiCA regulation and the FATF Travel Rule — are forcing bridges and exchanges to collect and share more user data.

However, the fundamental challenge remains: decentralized bridges do not collect user data, and they operate across jurisdictions where no single legal authority has control. Thorchain, for example, has no headquarters, no legal entity, and no compliance team. You cannot serve a freeze request on Thorchain. You can only trace through it and try to catch the funds at the next exchange.

This is why speed is the most important factor in chainhopping cases. Every minute the scammer has is a minute to move funds further. If you have been scammed and the funds are still on the original blockchain, do not wait. The longer you wait, the more bridges the scammer can use, and the harder recovery becomes. Contact us immediately — our tracing team can begin cross-chain analysis within hours of receiving a case.

The bottom line

Chainhopping is the defining challenge of modern crypto recovery. Scammers move stolen funds across multiple blockchains via cross-chain bridges to break the forensic trail. Each bridge hop interrupts the tracing, requiring specialized knowledge and tools to follow. But it is not untraceable — every bridge transaction leaves a trail, and with the right expertise, the funds can be followed across chains. The key is speed: identify the bridge pattern, trace through the hops, and get a freeze request to the destination exchange before the funds are cashed out.

If you have lost cryptocurrency to a scam and the funds have been moved across chains, contact us. We have experience tracing through Thorchain, Stargate, Across, Wormhole, Synapse, deBridge, and the major swap services. The earlier we start, the more likely we are to catch the funds before they disappear.

N. Silinevics
Nils Silinevics Crypto Compliance Counsel · Former FIU Investigator · Valken Legal AG