According to estimates in Great Britain, based in Great Britain in the British British Blockchain Analytics Analytics company, at least $ 21.8 billion in the cryptocurical illegal or high risk of illegal cryptocurrencies or high risk flowed through exchanges, compared to $ 7 billion in 2023. Attributes of 12% of these movements to North Korea.

Transitional swaps were once a niche activity reserved for advanced traders and decentralized finance users (DEFI), but they transformed into a basic element of money laundering. Illegal actors do not simply send crypto by mixers or drop tokens on one decentralized exchange (DEX). Nowadays, funds move around many blockchains to frustrate researchers and avoid detection.

This rapid enhance by 211%, from 7 billion to $ 21.8 billion, reflects the growing exploit of Blockchain, DEX and coins replacement services, as well as the growing number of blockchain.

“When you look back, say ten years ago, the main cryptocurrencies and blockchains were Bitcoin and Ethereum and a few others,” said Cointtegraph, researcher Elliptic Apac Crypto.

“This is an increasingly multidirectional ecosystem … which simply expands the available assets and available darkening channels open to criminals.”

Bridges are passing motorways

A single bridge transaction may reflect the usual behavior of the user, but the patterns of structural activity or many hopes are red flags for coordinated efforts to break the onchain trail, said Eliptyc 2025 Transitional crime report Posted on Wednesday.

The structural madness of the chain consists in dividing the funds and distributing them simultaneously into several blocks. Multi-hop chain hoping is a multiple transfer of assets from one chain to another. Both techniques are ineffective due to design and are equipped with high fees to mistake researchers.

These methods are increasingly common in high rate washing operations. In one case from the beginning of 2025, hackers suspected that they were associated with North Korea, stole $ 75 million from unnamed exchange and completed sequence funds from Bitcoin to Ethereum, and then to the arbitrarum, base and finally throne-using both the structure and multi-hop.

Related: From Sony to Bybit: How Lazarus Group became a supervillain of cryptocurrencies

These patterns are no longer confined to state entities or enormous -scale theft. In a separate case regarding fraud of USD 200,000 in Great Britain, now configured The culprits will divide funds into 90 different assets into many chains to finance online gambling.

Wanted Funa explained:

“This is not just a high-level activity reserved for the main hackers. You have smaller criminals who use the jumping chain for funding funds finance gambling or minor fraud. In this way this tactic has become.”

Elliptical estimates that about a third of blockchain research now includes tracking of flows in at least three different networks.

Washing in the passage begins in DEFI

DEX are often seen as lucid and identical because they work on blocks. However, they are increasingly used as the entry points in the cryptocurrency washing cycle, especially when tokens with low credibility are involved.

DEX are platforms on which such resources can be converted into widely accepted tokens, such as USDT (USDT) or Ether (Ether) without relying on centralized platforms that can enforce the principles of know your client (kyc).

The case study in the Elliptic report analyzed the exploit from May 2025 in Cetus – the main liquidity supplier at Blockchain Sui – which enabled the attorney to empty over $ 200 million tokens. The attacker initially used DEX to convert USDT into USDC, which elliptical suspects could take advantage of lower bridge costs.

Related: Twice cheerful? The Cetus recovery plan for Sui reflects the Solan plan

These stablecoin was then separated to Ethereum, where the DEX aggregator was reused to transform USDC into ETH. Centralized stablecoin, such as USDT and USDC, have functions that allow their issuers to freeze funds. The ether, which is a native advantage of blockchain ethereum, has no this functionality by nature.

Criminals also exploit an open project of DEX aggregators and automatic market manufacturers (AMM) to conduct transactions in a way that reduces slip and avoid detection. For example, laundry flows often go through many unclear trading pairs before settling in a liquid tox. In many cases, these swaps are performed in petite parts or with the assist of smart contracts to avoid causing money laundering alarms (AML).

Although Dex is not cross by nature, the distinction becomes less clear in newer services, because they also offer native swaps between the Akas, said Elliptic.

SWAP SITES Star coins in Cross washing

Monet replacement services work more than underground currency changers. They allow users to replace resources anonymously in various blocks with minimal friction, without registration and often without significant control of counteracting money laundering (AML). As a result, these services have become a tool for a wide range of illegal actors, especially those operating on Darknet markets, ransomware networks and online cheating cards.

These platforms differ from bridges and DEX, because they act as centralized brokers, but intentionally operate in cloudy or acceptable jurisdictions. A lot is advertised directly on Darknet forums and telegram channels, often promising to accept “dirty btc” or emphasizing their failure to seek law enforcement agencies.

Some even offer services, such as armed cash converters, counting money or decreases in “treasures”, in which the physical currency is buried in previously established locations in exchange for crypto.

Elliptic has announced that about 25% of illegal and high risk flows through the services of converting coins are associated with online gambling, especially platforms without mainstream licenses. Many of these places, especially those associated with Russian operators and south-eastern Asian, are also associated with fraud, such as Świni Rzeźnice and drug trafficking, creating a closed high-risk loop, which are recycling between illegal gambling and washing.

Tools for cats and mice chasing transition washing

Hopping a chain, once a fine tactic, is now routine. Washing methods, which once consisted of mixers or plain swaps, have evolved into complicated sequences covering many chains, tokens and platforms – often structured to waste time of analysts or a breakthrough of automated tracking.

In an elliptics worth $ 75 million related to North Korea, the stolen funds were quickly transferred to five different blocks. Similar patterns currently appear in smaller cases of fraud, which indicates that the complexity itself has become a deliberate strategy.

Tracking these movements still depends on visibility – and a growing set of tools. Platforms such as an elliptical researcher, the plot of Chainalysis and TRM Forensics are built to automate and visualize transitional analysis, while centralized Stablecoin emitters will reserve the possibility of freezing with marked assets.

“It doesn’t matter if they tried to do it in five different blockchains or only once – we are able to automatically track these funds through our investigation tools. Something that is really manual and can take several hours, you can now do for ordinary clicks and minutes, because everything is automated,” said Akartuna.

This is an uneven match, but the infrastructure for fighting cryptographic crime is also adapting.

Warehouse: Inside, 30,000 farms stealing cryptographic theft from real users