Cross-chain tracing is the forensic work of following stolen cryptocurrency as it leaves one blockchain and reappears on another, through bridges, swaps and decentralized exchanges. It is usually possible, but how reliable the result is depends on the type of bridge, the amounts involved and how quickly the evidence is preserved. At Recovera Forensics, we build this kind of trace into forensic reports designed for legal proceedings, because a trace only helps a victim when it is documented well enough for an exchange, a lawyer or a court to act on.
TL;DR
- Cross-chain tracing links activity on two or more blockchains. A single-chain trace stops at the point where funds enter a bridge or swap.
- Many bridges leave deterministic identifiers, so an investigator can often look up the matching transaction on the destination chain instead of guessing.
- Mixers and busy bridges with round amounts are harder. Investigators then rely on timing, volume and the points where funds enter and leave.
- Tracing shows where value went. Getting it back usually requires it to reach a regulated exchange or another point where a court or institution can act.
- Save transaction hashes, wallet addresses, exact times and amounts now, and report to IC3.
Table of Contents
- What cross-chain tracing is, and how it differs from single-chain tracing
- Why criminals hop chains
- How investigators follow funds across bridges, swaps and networks
- What a cross-chain trace can and cannot establish
- Tracing is not the same as recovery
- What to preserve before anyone starts tracing
- From trace to usable evidence
- A worked example of a multi-hop path
- Promo: when to bring in a forensic investigator
- Frequently asked questions
- Sources
What cross-chain tracing is, and how it differs from single-chain tracing
On a single public blockchain such as Bitcoin or Ethereum, every transfer is recorded in an open ledger. An investigator starts at the victim’s transaction, follows each output to the next address, and maps the path. That is difficult at scale but conceptually simple: one ledger, one set of rules.
Cross-chain tracing is the same discipline applied when the money changes ledgers. A cross-chain bridge is an application that moves assets from a source blockchain to a destination blockchain. When a thief sends stolen ether into a bridge contract, the ether does not travel anywhere. It is locked or burned on one chain, and an equivalent asset is released or minted on another. The two events are recorded on two different ledgers, and nothing in the first ledger names the receiving address on the second.
That gap is what makes the technique a specialty. A tracer has to answer three questions:
- Which bridge, swap router or protocol did the funds enter?
- Which transaction on the other chain is the matching exit?
- Who controls the receiving address, and where does it lead next?
The MITRE AADAPT framework describes this behavior as cross-chain hopping: adversaries exploit the interoperability of blockchain networks to move assets between chains, which makes their activity harder to trace, using anonymous wallets, bridges, decentralized exchanges and atomic swaps.
Why criminals hop chains
Hopping is cheap, fast and automated. A scammer can convert a stolen token into another asset on a different network in minutes, then repeat the step several times. Each hop forces a single-chain investigator to switch tools, data sources and assumptions.
The scale of the problem is large. The FBI’s Internet Crime Complaint Center received cryptocurrency-related complaints from victims in over 200 countries in 2023, with 57,762 U.S. complaints and $4,809,737,956 in losses. The Treasury’s FinCEN reviewed 33,904 reports of suspected digital-asset investment scam activity filed between September 8, 2023 and December 31, 2025, representing approximately $12.7 billion in related financial activity. The same reporting notes that launderers use money mule networks and stablecoin transfers to exchanges outside the United States, which is exactly the kind of route that crosses chains and borders.
How investigators follow funds across bridges, swaps and networks
There is no single method. A competent trace combines several, chosen by what the funds actually did.
Bridges that leave identifiers
The good news for victims is that many bridges pass messages between chains, and those messages carry identifiers. According to a 2026 practitioner write-up on tracing stolen crypto across chains, Wormhole uses VAA sequence numbers, LayerZero uses GUIDs and Circle’s CCTP uses nonces. With those, the investigator performs an identifier lookup, not a guess. The source transaction on chain A points to a specific delivery on chain B, and the destination address is read directly from the record.
So the answer to the question many victims ask, whether bridging is traceable at all, is yes. How hard it is depends on which kind of bridge was used.
Bridges that need correlation
When a bridge does not expose a clean identifier, tracers fall back on correlation: matching the amount, the token, the timing and sometimes the fee pattern between a deposit and a withdrawal. The same source is candid about the limit. If two hundred people bridged ten ether in the same block, the match is a guess. Correlation works well on unusual amounts in quiet periods and poorly on round numbers through busy bridges.
This is why experienced analysts treat a correlation match as a lead with a stated confidence level, not as a finding. In a report meant for a lawyer, that distinction matters.
Swaps and decentralized exchanges
A swap on a decentralized exchange converts one token to another inside a smart contract, and the whole exchange is visible on-chain: the input token, the output token, the pool and the receiving wallet. Tracing through a swap is therefore usually straightforward. The complexity comes from chains of swaps, where a thief converts to a stablecoin, then to another coin, then bridges, then swaps again. Each link has to be documented so the final position can be tied back to the original theft.
Wallet clustering and attribution
Addresses are not people, but behavior links them. Reusing a funding wallet, paying fees from the same source, or consolidating funds from many addresses into one can show that several addresses on different chains belong to the same operator. The same wallet address often exists on several EVM-compatible networks, so activity under one address on multiple chains is a common thread. Combined with open-source intelligence, this can tie wallets to a wider fraud network. Our OSINT and digital attribution work is built for this step.
Mixers
Mixers are the hardest case. Against a mixer, investigators generally cannot link a deposit to a withdrawal cryptographically. What they can do is establish volumes and timing, use amount and timing correlation on low-activity days, and, most productively, attack the operator rather than the protocol, according to the same 2026 tracing write-up. Another law enforcement tracing overview makes a similar point: confidence may drop at a mixer, but entry and exit flows can still be monitored, especially when large amounts or unusual timing narrow the field. We cover that in more detail in our guide to tracing crypto mixers.
What a cross-chain trace can and cannot establish
A useful trace separates three levels of certainty, and a good report labels each one.
| Level | What it means | Typical example |
|---|---|---|
| Direct | The record on-chain states the link | A swap in a single transaction, or a bridge with a message identifier |
| Strong inference | Several independent signals agree | Unique amount, tight timing and a shared funding wallet |
| Lead | Plausible but not provable alone | A round amount through a busy bridge or a mixer |
What a trace reliably gives you is the path: which addresses held the funds, in what order, on which chains, and where the money sits now. What it does not give you by itself is a legal right to the money. A U.S. law firm practice page on crypto asset recovery notes that a blockchain trace can show where assets moved, but ownership, authorization, account control and the identity of the responsible party may still require separate proof.
Tracing is not the same as recovery
This is the point most victims need to hear early. Tracing establishes where stolen value has gone. Recovery requires that the assets reach a place where a court or a cooperating institution can act, and the most important such place is a regulated exchange, according to Digital Asset Law.
That is why the end of a cross-chain trace matters more than its length. A path that ends at a deposit address at a regulated exchange can support a freeze request or a legal demand. Our guides on exchange-to-exchange tracing and on whether exchanges can freeze stolen crypto explain why speed matters: the shorter the time between the theft and the exchange contact, the better the options.
When stolen funds are mixed with other money, U.S. law offers doctrines for following value through the commingled pool. The same Digital Asset Law resource explains that a constructive trust treats a wrongdoer holding identifiable property derived from fraud as holding it for the victim’s benefit, and that the lowest intermediate balance rule limits tracing into a commingled account. Whether those doctrines apply to your facts is a question for a lawyer. What a lawyer needs from the forensic side is a clear, reproducible account of where the money went.
What to preserve before anyone starts tracing
The quality of a cross-chain trace depends on what the victim saves in the first hours. For each transfer, compile the transaction hash, the wallet address, and the exact time and amount. One victim guide describes this as a three-piece set, best organized in a table with links to the blockchain explorers where the data was verified.
The FBI asks for the same details. Its cryptocurrency report says the most important information to include in a complaint is cryptocurrency addresses, the amounts and types of cryptocurrency, transaction hashes, and the dates and times of the transactions. It also encourages submitting a complaint through IC3.gov.
A practical checklist:
- Copy every transaction hash for the transfers you made, from your wallet or exchange history.
- Record the destination address for each transfer and the chain it was on.
- Note the exact date, time and time zone, plus the amount and token.
- Save screenshots of chats, websites, emails and payment instructions from the scammer, with URLs and usernames.
- Do not send more money to anyone offering to release funds or pay a fee to unlock your account.
- File a report with IC3.gov and keep the confirmation.
Our step-by-step guide for U.S. victims walks through the first 24 hours in order, and our work on preservation of evidence and digital footprint covers capturing material so that it can be authenticated later.
From trace to usable evidence
A trace that lives in a spreadsheet or a screenshot of a graph is hard to use. A report that holds up for a lawyer, an exchange compliance team or a court has to show its method. Every hop should be documented with the transaction hashes on both sides of each bridge or swap, the identifier or correlation logic used to connect them, and a confidence level for each link. It should also state which findings are direct, which are inference and which are leads, and it should be reproducible by another analyst from public data.
That is the standard we work to. If you want to see how reports are shaped for attorneys, read what a usable crypto tracing report for law firms contains, and for the admissibility side, our guide to using crypto forensics in U.S. court. Law enforcement and regulators also depend on good reporting: FinCEN has said that Bank Secrecy Act reporting is essential to law enforcement investigations and victim recovery, and it encourages institutions to share information voluntarily under Section 314(b) of the USA PATRIOT Act, which carries a liability safe harbor, as reported in September 2026.
A worked example of a multi-hop path
To make this concrete, consider a hypothetical case, not a real client. A victim sends USDT on Ethereum to a fake trading platform. Within an hour the funds are split across five addresses. Two of them swap USDT for ether on a decentralized exchange. One of those then sends the ether through a bridge that emits a message identifier. An investigator reads the identifier, finds the matching delivery on another network, and sees the funds arrive at a fresh address. That address consolidates with deposits from two other victims’ cases and then sends a large transfer to a deposit address at a centralized exchange.
At each stage, the trace produces something different. The swaps give direct evidence. The bridge identifier gives a direct link across chains. The consolidation suggests a shared operator. The exchange deposit gives the point where a freeze request or a legal demand can be directed. If instead the thief had used a mixer, the report would state the entry and exit points, the volume and timing, and the level of confidence, and would not claim a certain link that the data cannot support.
Promo: when to bring in a forensic investigator
If your funds crossed a bridge, went through swaps or touched more than one network, the manual route through block explorers becomes slow and error-prone, and delay costs options. Recovera Forensics offers cryptocurrency scam investigation, OSINT and digital attribution, and preservation of evidence, and technical reports for law firms through our professional offices service. We do not publish a price for these services.
Our perspective
Most victims come to cross-chain tracing believing the trail goes cold at the first bridge. In our experience of how these cases are built, that is rarely the whole story. Public blockchains record every step, and the real work is connecting the records on one chain to the records on the next, then proving the connection in a way another person can verify.
Our approach is to go deeper than basic wallet tracking. We analyze transaction patterns on public blockchains, reconstruct asset flows including through mixers and bridges, and connect wallet activity to potential fraud networks. We then put the findings in a technical report that is written for legal proceedings, and we work directly with law firms so that the forensics and the legal strategy fit together.
We also believe in a transparent, victim-centered process. You should know what a trace shows, how strong each link is, and what the next step is. A report that says exactly that is more useful to an exchange or a court than a dramatic graph.
cristian
Frequently asked questions
Is cross-chain bridging traceable?
Yes, in most cases. Many bridges emit identifiers such as sequence numbers, GUIDs or nonces that let an investigator match the source transaction to the destination transaction directly. Where no identifier exists, tracers use amount and timing correlation, which is weaker on busy bridges and round amounts.
Can cross-chain tracing get my crypto back?
Tracing shows where the funds went, but it does not return them on its own. Recovery usually depends on the funds reaching a regulated exchange or another point where a court or institution can act. A clear trace report is what lets a lawyer or an exchange compliance team take that action quickly.
What should I save before a cross-chain investigation?
Save the transaction hash, the wallet address, and the exact time and amount for every transfer, and organize them in a table with explorer links. Keep screenshots of all communications with the scammer. File a complaint at IC3.gov with the same details.
Can transactions through a mixer be traced?
A mixer usually prevents a cryptographic link between a deposit and a withdrawal. Investigators can still establish volumes and timing, look for amount and timing patterns on low-activity days, and follow the flows into and out of the service. Results are reported with a stated level of confidence.
How is cross-chain tracing different from tracing on one blockchain?
On one chain, every step is in the same ledger and can be followed address to address. Across chains, the sending and receiving sides sit in different ledgers, so the investigator has to prove the connection between them using bridge identifiers, swap records or correlation.
Sources
- Cross-Chain Swaps (Hopping), MITRE AADAPT
- What Is A Cross Chain Bridge?
- Tracing Stolen Crypto Across Chains, SecJuice
- How Law Enforcement Traces Cryptocurrency, Blockchain Council
- FBI IC3 2023 Cryptocurrency Report
- FinCEN pig butchering analysis, via CryptoTimes
- Crypto Fraud & Asset Recovery, Digital Asset Law
- Crypto Asset Recovery for Stolen or Misappropriated Assets, Daeryun Law
- How to Recover Lost Crypto Funds: A Practical Guide for Victims
