Section 7 · Lesson 7.4
Chain-hopping: jumping across networks and bridges
Chain-hopping (sometimes cross-chain layering) is laundering by switching blockchains: funds are driven from one network into another through bridges and cross-chain swaps, often changing the asset itself along the way. The calculation is simple: an analyst used to seeing a single network "loses the trail" at the border, because in the other network a formally new token appears on a new address. Let us take apart a typical route, ETH→bridge→BSC→swap→TRON, understand why it is done, and see how modern tools "stitch" the broken chains back together.
Why switching networks "hides" anything at all
Each blockchain is a separate ledger with its own addresses, formats, and explorers. A transaction on Ethereum and a transaction on TRON share no common on-chain identifier: there is no "wire" between them carrying one and the same UTXO or one and the same token. When you "move" USDT from Ethereum to TRON, physically no coin travels across the border — the original funds are locked or burned on one side, and an equivalent is issued on the other. It is precisely this break ("burn-and-mint" or "lock-and-mint") that creates the blind spot: naive tracing runs into the bridge contract and does not know which of the thousands of bridge outputs on the other side corresponds to your particular input.
ETH
dirty ETH
→
Bridge
lock/burn
→
BSC
mint the equivalent
→
Swap
change the asset
→
TRON
cash out USDT-TRC20
The typical route step by step
- Start on Ethereum. On the address is "dirty" ETH or an ERC-20 token (for example, stolen in a DeFi hack).The network is transparent, so the funds cannot be held here for long.
- Crossing via a bridge into BSC. The funds are fed into a bridge contract; on the Ethereum side they are locked/burned, and on the BSC side an equivalent is minted.This is where the "break" for naive tracing occurs.
- A swap inside BSC. On a DEX the equivalent is exchanged for another asset (say, into USDT or an intermediate token), which additionally changes the "face" of the funds.Changing both the network and the asset in one layer strengthens the obfuscation.
- Another bridge into TRON. From there — into TRON, where USDT-TRC20 is cheap to transfer and popular for P2P cash-out.TRON is often the final cash-out network because of cheap fees and liquid P2P.
- Cash-out. In TRON the funds are fragmented (see lesson 7.2) and withdrawn through P2P/swap services into fiat.The final detachment from the dirty root across three different ledgers.
Why jump across networks. The goal is layering across the borders of data jurisdictions. Each jump: (1) breaks the single graph — the tracer has to manually "re-glue" the bridge input and output; (2) changes the asset, throwing off scoring by a specific token; (3) moves the flow into a network with different liquidity and different cash-out norms (TRON/BSC are often more convenient for cash-out than Ethereum); (4) increases the number of tools and venues the investigator has to cover, raising the cost and time of the case.
How modern tools "stitch" chains together
The break at the bridge is an illusion, not an insurmountable wall. Cross-chain analytics (Chainalysis, TRM, Elliptic, Arkham, and graph engines like the one behind our audit) have learned to restore the "bridge input ↔ bridge output" correspondence with high confidence. The main techniques:
- Matching amounts and timing (value/time matching)41.6273 tokens went into the bridge — and minutes later almost the same amount came out on the other side, less the bridge fee. A non-standard amount makes the pair all but unambiguous.
- Logs and events of bridge contractsMany bridges emit events with transfer identifiers, relayer addresses, and metadata that directly link the two sides. This is a structural "stitch," not a guess.
- Shared addresses and service depositsSwaps and bridges often go through service/deposit addresses that analysts have already clustered and labeled.
- Behavioral fingerprintsThe same initiating wallet on both sides, a characteristic "before/after" route, a recurring pattern of gas and timing — all of it glues the edges together.
- A single cross-network ontologyModern platforms keep the data of many networks in one graph, so the "crossing" is displayed as a single logical edge between an ETH and a BSC address, not as a break.
Signs of chain-hopping on the graph
- The flow runs into a known bridge contractInteraction with an address tagged as a bridge — and the "disappearance" of the flow after it.
- A rapid bridge→swap→bridge sequenceThe funds do not linger: they entered, swapped, and moved onward into another network within minutes/hours. A transit, not a user, signature.
- An asset change at each layerETH→wrapped→USDT→another token: the goal is not convenience but breaking scoring by a specific coin.
- Finalization in a "cheap" networkConvergence in TRON/BSC before fragmentation and P2P cash-out.
- Matching amounts on the two sides of the bridgeIf "by eye" the bridge input and output match in size and timing — you have already found the stitch manually.
How to tell it apart from legitimate cross-chain
Bridges and swaps are an entirely normal tool: people move assets for cheap fees, access to DeFi in another network, participation in staking. Context helps tell intent apart from everyday use:
- The origin of the rootLegitimate cross-chain starts from a clean source (an exchange withdrawal, a salary in stablecoins). Chain-hopping grows from a "bad" root — a hack, a scam, a sanctioned address.
- The number and speed of layersAn ordinary user makes one crossing and stays in the target network. A launderer layers bridge-swap-bridge-swap in a row with no economic sense.
- Whether the funds lingerA legitimate transfer often precedes real use (LP, staking, a purchase). Transit without a stop is a marker of layering.
- The endpointThe norm is that funds settle/go to work. Laundering is a quick cash-out after fragmentation.
A practical risk for the user. Even a bona fide cross-chain move can "pick up" risk: if you swapped tokens in a pool that stolen funds had just entered, part of the "taint" can be reflected in scoring. And coming out of a bridge known for major hacks sometimes raises the risk score by itself. Check not only your direct counterparty but the origin of the asset before the bridge.
In sum: chain-hopping is layering across the borders of blockchains, exploiting the absence of a common on-chain identifier between networks and the lock/burn-mint mechanics of bridges. The route ETH→bridge→BSC→swap→TRON breaks the graph, changes the asset, and moves the flow into a network convenient for cash-out. But the break is illusory: matching amounts and timing, bridge-contract events, clusters of service addresses, and a single cross-network ontology make it possible to "stitch" the chain back together. Next comes a completely different class of attacks, where it is not the analyst who is deceived but the user themselves: address poisoning.
This material is for educational purposes.