A cross-chain bridge is a protocol that moves value between separate blockchains, usually by locking or burning an asset on one chain and minting or releasing a matching version on another. Bridges are central to chain hopping and hold large pooled balances, which makes them both a laundering tool and a top target for huge thefts.
What is a cross-chain bridge, in plain English?
Blockchains do not natively talk to each other. A coin on one chain cannot simply appear on another. A cross-chain bridge solves that by acting as a connector: it locks or burns your asset on the origin chain and mints or releases a matching version on the destination chain. To the user it feels like moving funds from one chain to another, even though the original asset never actually leaves the first chain.
Bridges are essential plumbing for a multi-chain ecosystem, letting liquidity and users flow where they want to go. But two features make them a compliance concern. First, they are the mechanism behind chain hopping, the layering technique that breaks tracing by jumping funds between chains. Second, the lock-and-mint model means a bridge accumulates large pooled balances of locked assets sitting behind contract code.
That concentration of value behind smart contracts makes bridges a top target for major thefts. When the code has a flaw, an attacker can drain the pool in one exploit. For monitoring, bridge deposits and withdrawals are important tracing chokepoints, and a spike in unusual bridge flows right after an exploit is a strong laundering signal.
How a bridge moves value
- Deposit — User sends to the bridge. The asset is deposited to the bridge contract on the origin chain.
- Lock — Origin asset locked or burned. The bridge secures or destroys the asset so it cannot be spent twice.
- Mint — Matching asset released. A wrapped or native equivalent is minted or released to the user on the destination chain.
- Chokepoint — Trail hands off. The on-chain link does not carry across automatically, so the trace must be stitched deposit to withdrawal.
Who is involved?
Who | Their role |
Legitimate users | Move assets between chains to access apps, liquidity, or lower fees. |
Launderers | Use the bridge as a chain-hopping hop to break the tracing trail. |
Exploiters | Target the bridge's pooled balances and contract code to steal at scale. |
The analyst | Treats deposits and withdrawals as chokepoints and matches them to keep a trace alive. |
What it looks like in practice
In practice
An attacker who has just drained a lending protocol sends the stolen funds into a bridge. The assets are locked on the origin chain and a wrapped version is minted to the attacker on a second chain. A single-chain trace ends at the bridge deposit and appears to lose the money.
An analyst keeps going by matching the deposit's timing and amount to a withdrawal on the destination chain, confirming the same funds crossed over. Separately, when the bridge itself is exploited on another occasion, its large locked pool is drained in one transaction, and a sudden burst of outbound bridge flows becomes the clearest early sign of laundering in progress.
Why it matters to operators
Bridges concentrate two kinds of risk. As infrastructure, their pooled balances behind contract code make them one of the largest single points of failure in crypto, and bridge exploits have produced some of the biggest thefts on record. As a laundering rail, they create the tracing gaps that chain hopping depends on, so a team that stops tracing at a bridge deposit will lose fast-moving stolen funds.
The operator takeaway is to treat bridge deposits and withdrawals as chokepoints to watch rather than dead ends. Matching the two sides of a bridge move keeps a trace alive, and a spike in unusual bridge flows immediately after an exploit is a high-value early signal worth escalating quickly, because that is when funds are most catchable.
What to watch in the data
- Traces ending at a bridge. A deposit into a bridge is a handoff to look past, not a place to stop tracing.
- Deposit-to-withdrawal matches. Timing and amount correlation across chains links the two sides of a bridge move.
- Post-exploit flow spikes. A surge of unusual bridge activity right after a hack is a strong laundering signal.
- Large locked pools. Bridges holding big pooled balances are prime exploit targets; monitor their contracts and outflows.
- Repeated favored bridges. Criminals reuse specific bridges; concentration there marks a chokepoint worth close watch.
Quick questions
Are cross-chain bridges illegal or suspicious?
No. They are core infrastructure that ordinary users rely on to move between chains. They become a compliance concern only through misuse, such as chain hopping to launder funds, or when the bridge itself is exploited.
Why do bridges get hacked so often?
They hold large pooled balances of locked assets behind smart-contract code. That concentration of value plus complex code makes them a high-reward target, and a single flaw can let an attacker drain the whole pool at once.
How does a bridge break a trace?
It locks or burns the asset on one chain and mints or releases a matching version on another, so the on-chain link does not carry over automatically. Investigators must stitch the deposit on one chain to the withdrawal on the other to continue the trace.
What is a wrapped asset?
It is the matching version of an asset that a bridge issues on the destination chain to represent the value locked on the origin chain. It lets a token from one chain be used on another while the original stays locked.
How are bridges linked to chain hopping?
Bridges provide the cross-chain jump that chain hopping is built on. A launderer bridges funds to a new chain, often swaps assets, and repeats, using each bridge crossing as a gap that single-chain tracing cannot follow.
What should a team do when funds hit a bridge?
Do not stop the trace. Match the bridge deposit to the corresponding withdrawal on the destination chain by timing and amount, and treat unusual post-exploit bridge flows as an escalation trigger while the funds are still catchable.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.