Cybercriminals have been shifting away from cryptocurrency mixers towards cross-chain bridges at an accelerated rate over the past year, as reported by blockchain forensics firm Elliptic.
According to Elliptic’s data, in June and July, nearly all stolen cryptocurrencies were funneled through cross-chain bridges, marking a complete reversal from the first half of 2022.
In a blog post dated September 18, Elliptic attributes this trend to the “crime displacement” effect, where criminals adapt to new methods when their existing methods face increased scrutiny. However, the transition to cross-chain bridges is happening even faster than initially predicted.
The shift in the proportion of funds laundered between cryptocurrency mixers and cross-chain bridges occurred between January 2022 and July 2023. This shift was largely catalyzed by the U.S. Office of Foreign Asset Control’s sanctions on Tornado Cash in August 2022.
Elliptic notes that many cybercriminals, including the North Korean-backed Lazarus Group, turned to the Avalanche bridge after the sanctions on Tornado Cash. This same bridge was reportedly utilized by the Lazarus Group in facilitating part of the stolen funds from the $41 million Stake exploit on September 4, according to blockchain security firm CertiK.
Crypto mixers experienced a temporary resurgence between November 2022 and January 2023, following the closure of RenBridge in December due to the collapse of its financier, Alameda Research, amid FTX’s bankruptcy. Elliptic estimates that RenBridge facilitated the laundering of $500 million during its operation.
However, shortly thereafter, criminals once again favored cross-chain bridges, even more so than before.
Elliptic suggests that criminals may prefer cross-chain bridges because it is challenging for blockchain forensic firms to trace illicit activity across different blockchains in a scalable manner.
“Criminals are aware that traditional blockchain analytics solutions lack the capability to track illicit blockchain activity across various blockchains or tokens in a systematic and scalable way.”
Additionally, many of the stolen tokens can only be exchanged through cross-chain bridges, and most of these DeFi services do not require identity verification, as explained by Elliptic.
The firm estimates that approximately $4 billion in illicit or high-risk cryptocurrencies have been laundered through cross-chain bridges since 2020.
