Curriculum·G103 Fund-Flow Tracing and Forensics·about 31 min
Across bridges and chains
By the end of this lesson you can
- →Explain how a cross-chain bridge moves value between ledgers and what it leaves recorded on each
- →Explain how hundreds of millions in criminal proceeds were traced through RenBridge across chains
- →Compute a cross-chain match from the deposit on one chain and the mint or release on another
- →Distinguish a bridge, which usually preserves a matchable correspondence, from a mixer, which pools
Graduate · enrolled learners
This lesson opens with RenBridge cross-chain laundering, reported 2022.
- What happened
- A cross-chain bridge lets value move between separate ledgers: you lock or deposit an asset on one chain, and the bridge releases or mints a corresponding asset on another. In 2022 the firm Elliptic reported that at least about 540 million dollars in criminal proceeds, including ransomware funds and money from the Ronin bridge hack, had been laundered through RenBridge since 2020, precisely to jump between chains and shake off single-chain tracing. But a bridge is not a mixer. It records a deposit on the source chain and a matching release on the destination chain, usually in a corresponding amount and close in time, so the two halves can be matched: the funds that entered on Ethereum and the funds that emerged on Bitcoin are tied by the bridge's own recorded behavior. Investigators followed the flows across the jump by pairing deposits with releases, which is why the cross-chain laundering was reported at all.
- The decision point
- Crossing chains feels like leaving the graph, and for a single chain's heuristics it is: an address trail on Ethereum simply does not continue onto Bitcoin, because they are different ledgers with different addresses. A bridge is the seam between them, and the analyst's move is to treat the bridge as a matchable correspondence rather than a dead end. Unlike a mixer, which pools many parties' funds and re-emits them from a shared reserve, a bridge typically releases a specific corresponding amount for a specific deposit, so the deposit on chain A and the release on chain B can be paired by amount and timing, sometimes exactly through the bridge's own records. That pairing carries the trail across the jump. Cross-chain tracing is therefore mostly about recognizing the seam and matching across it, and a launderer who thinks a bridge ends the trail has usually only made it two-chain.
- Recorded loss
- $540,000,000
What you will be able to answer
- →What does a cross-chain bridge do, and what does it record?
- →Why was RenBridge laundering traceable across chains?
- →How does a bridge differ from a mixer for tracing?
- →How do you trace across a bridge?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.elliptic.co/blog/540-million-laundered-via-renbridge
- https://www.chainalysis.com/blog/cross-chain-crime-2023-crypto-crime-report-preview/
- https://www.chainalysis.com/blog/how-crypto-tracing-works/
Confidence high·Volatility medium·Reviewed 2026-09-15·Owner unassigned
Contested
Elliptic reported at least about 540 million dollars in criminal proceeds laundered through RenBridge since 2020; the figure is a lower-bound estimate and the true total is uncertain. The matchability of a bridge depends on its design; some bridges obscure the correspondence more than others.
Not every bridge preserves a clean one-to-one deposit-to-release match; batching and pooling in some designs push a bridge toward mixer-like behavior, handled by correspondence methods.