Ethereum News Today: Illicit Crypto Flows Through Crosschain Swaps Surge 211% to $21.8 Billion

At least $21.8 billion in illicit or high-risk crypto has flowed through crosschain swaps, marking a significant increase from $7 billion in 2023. This surge reflects the growing use of blockchain bridges, decentralized exchanges (DEXs), and coin swap services, as well as the expanding number of blockchains. Crosschain swaps, once a niche activity, have evolved into a core component of money laundering, with illicit actors employing complex tactics to evade detection.

Arda Akartuna, Elliptic’s APAC lead crypto threat researcher, highlighted the evolution of the cryptocurrency ecosystem. A decade ago, the primary cryptocurrencies and blockchains were Bitcoin and Ethereum. Today, the ecosystem is increasingly multichain, providing more assets and obfuscation channels for criminals. This multichain environment has led to a 211% increase in illicit funds moving through crosschain swaps, from $7 billion to $21.8 billion.

Elliptic’s 2025 crosschain crime report revealed that a single bridge transaction might reflect ordinary user behavior, but patterns of structured or multi-hop activity are red flags for coordinated efforts to break the onchain trail. Structured chain-hopping involves splitting funds and distributing them simultaneously across several blockchains, while multi-hop chain-hopping is the act of moving assets from one chain to another repeatedly. These techniques are designed to be inefficient and come with high fees to confuse investigators.

These methods are increasingly common in high-stakes laundering operations. In one early 2025 case, hackers suspected to be linked to North Korea stole $75 million from an unnamed exchange and bridged the funds in sequence from Bitcoin to Ethereum, then to Arbitrum, Base, and finally Tron, employing both structured and multi-hop tactics. These patterns are no longer limited to state actors or large-scale thefts. In a separate case involving a $200,000 fraud in the UK, the now-convicted culprit split funds across 90 different assets on multiple chains to fund online gambling.

Elliptic estimates that around a third of blockchain investigations now involve tracing flows across at least three different networks. DEXs, often viewed as transparent and traceable, are increasingly being used as entry points in the crypto laundering cycle, especially when low-liquidity tokens are involved. These platforms allow assets to be swapped for more widely accepted tokens like USDt (USDT) or Ether (ETH) without relying on centralized platforms that may enforce Know Your Customer (KYC) rules.

A case study by Elliptic analyzed the May 2025 exploit on Cetus, a major liquidity provider on the Sui blockchain, that enabled attackers to drain over $200 million in tokens. The attacker initially used a DEX to swap USDT to USDC, which Elliptic suspects was possibly to take advantage of lower bridging costs. These stablecoins were then bridged to Ethereum, where a DEX aggregator was used again to convert the USDC into ETH. Centralized stablecoins like USDt and USDC have functions that allow their issuers to freeze funds, while Ether does not inherently have that functionality.

Criminals also exploit the open design of DEX aggregators and automated market makers (AMMs) to route transactions in ways that reduce slippage and avoid detection. Laundering flows often pass through multiple obscure trading pairs before settling in a liquid token. In many cases, these swaps are performed in small batches or via smart contracts to avoid triggering Anti-Money Laundering (AML) alarms. Though DEXs are not inherently crosschain, the distinction is becoming less clear in newer services as they also offer native cross-asset swaps.

Coin swap services operate more like underground currency changers, allowing users to anonymously exchange assets across different blockchains with minimal friction, no registration, and often no meaningful anti-money laundering (AML) checks. These services have become a go-to tool for a wide range of illicit actors, particularly those operating in darknet markets, ransomware networks, and online carding fraud. Many of these platforms advertise directly on darknet forums and Telegram channels, often promising to accept “dirty BTC” or emphasizing their non-cooperation with law enforcement.

Some coin swap services even offer services like armed cash pickups, money counting, or “treasure” cash drops, where physical currency is buried in pre-agreed locations in exchange for crypto. Elliptic reported that around 25% of illicit and high-risk flows through coin swap services are linked to online gambling, especially platforms lacking mainstream licenses. Many of these sites are also connected to scams such as pig butchering and narcotics trafficking, creating a closed loop of high-risk funds being recycled between illicit gambling and laundering networks.

Chain-hopping, once a fringe tactic, is now routine. Laundering methods that once relied on mixers or simple swaps have evolved into complex sequences that span multiple chains, tokens, and platforms, often structured to waste analysts’ time or break automated tracing. In the $75 million case Elliptic linked to North Korea, funds moved through five blockchains in rapid succession. Similar patterns are showing up in smaller frauds as well, suggesting that complexity itself has become the strategy.

Tracing these movements still depends on visibility, and a growing set of tools is being developed to combat this issue. Platforms like Elliptic Investigator, Chainalysis Storyline, and TRM Forensics are built to automate and visualize crosschain analysis, while centralized stablecoin issuers reserve the ability to freeze flagged assets. Akartuna noted that these tools allow investigators to follow funds automatically, reducing the time and effort required for manual tracing. Despite the challenges, the infrastructure for fighting crypto crime is adapting to keep pace with evolving tactics.