Follow the Money · 11 — The Bridge: The Launderer's New Highway

Follow the Money — Case 11. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Case 05 followed money that vanished inside a mixer — value hidden by breaking the link between deposit and withdrawal on one chain. Case 11 follows money that takes a different escape: not down into a pool, but sideways, across the boundary between one blockchain and another. The instrument is the cross-chain bridge, and it plays two roles in the criminal economy at once. It is the single richest target thieves have ever found. And it is the modern launderer's favorite highway.

A bridge exists because blockchains are islands. Ethereum cannot natively see Bitcoin; neither can natively see Solana or the dozens of other chains. A bridge connects them: you lock an asset into the bridge's contract on one chain, and the bridge mints a wrapped stand-in for it on another, so value can move where it otherwise could not. That connective tissue is enormously useful for legitimate users — and it created two criminal opportunities the register must follow. Because a bridge has to hold, in one contract, all the real value backing its wrapped tokens, it is a honeypot of pooled funds, and some of the largest single thefts in crypto history were bridge exploits. And because moving across a bridge carries value from a chain investigators are watching closely to one they may not be, the bridge became the key tool of chain-hopping — the laundering technique of scattering stolen money across blockchains to fracture its trail.

This is the letter about the highway. The disposition is LAUNDERED — not spent, not frozen, not vanished, but washed: run across chain after chain, swapped and split at machine speed between the crossings, until the origin is buried and the money can be cashed out clean. It is the classic laundering goal, achieved with a new road — and the register will show both why the road works and why it is slowly filling with cameras.

1. Why the Bridge Is the Richest Target

Begin with the theft, because it explains the structure that the laundering later exploits. A cross-chain bridge is, financially, a vault that must stay full. To issue a wrapped token on chain B that is genuinely worth one real coin on chain A, the bridge must be holding that real coin, locked, on chain A. Multiply across every user and every wrapped asset, and the bridge is sitting on a vast pool of locked value — the collateral behind everything it has minted. That pool is the whole point of the bridge, and it is also the whole prize for an attacker.

This is why bridges suffered catastrophes at a scale that dwarfs most other crypto thefts. Attacks on Wormhole, Nomad, Harmony, and the Ronin bridge each drained hundreds of millions of dollars in a single incident. The Ronin bridge is the same one behind Case 02: the roughly $620 million the DPRK's Lazarus Group stole and poured into its weapons program came out of a bridge. The reason these numbers are so large is structural, not incidental. In an ordinary exchange hack the attacker gets what is in a hot wallet; in a bridge exploit the attacker reaches the collateral behind an entire ecosystem of wrapped assets at once. Break the bridge's contract — a signature-verification flaw, a validator compromise, a logic bug — and you are not stealing a slice of the value, you are stealing the pool that backs all of it.

And the harm does not stop at the direct theft, which is what makes bridge exploits uniquely destructive. When the locked collateral is drained, the wrapped tokens it backed on the other chain become suddenly unbacked — IOUs for coins that are no longer there. Users who did nothing wrong, holding wrapped assets they believed were fully collateralized, can find their holdings worthless overnight. So the bridge exploit is a theft that radiates: it takes the pool, and it strands everyone who trusted the pool. That radiating structure is worth holding in mind, because the same feature that makes bridges catastrophic to rob — the concentration of value at a crossing point — is what makes them, in the laundering role, such an effective place to disappear a trail.

2. The Hop: How a Trail Is Fractured

Now the deeper subject of the case, which is not the theft but the wash. Most of what an investigator can do with a blockchain depends on a quiet assumption: that they are looking at one chain. Blockchain-tracing tools are extraordinarily good at following funds within a single network — every Ethereum transaction, every Bitcoin output, mapped and linked. The whole promise of the register's founding paradox — the ledger remembers — rests on that within-chain clarity. Chain-hopping is the technique built precisely to attack that assumption.

Here is the move, named explicitly in the US Treasury's DeFi assessment and in FinCEN's ransomware analysis, which both use the term chain-hopping. The launderer takes stolen value on chain A and bridges it to chain B — locking it on A, receiving the wrapped form on B. On the far side, the trail does not automatically continue in the investigator's tool; it has to be re-acquired, on a different chain, with different tokens, different conventions, and sometimes weaker analytics coverage. The Treasury assessment describes the surrounding maneuvers: swap the asset on a decentralized exchange into something compatible with the bridge, or into an asset with weaker illicit-finance controls, or into a form that evades sanctions. Then hop again. And again. Each crossing is a discontinuity — a seam where the money that was perfectly legible on one chain has to be found again on the next.

The crucial thing to understand is that this is not hiding, in the mixer's sense. In Case 05, the link between deposit and withdrawal was genuinely severed, absent from the record. Here, nothing is severed and nothing is absent: every hop is a fully public transaction, recorded permanently on both chains. The money is not concealed; it is scattered — spread across jurisdictions-of-code so that no single tool, watching a single chain, follows it end to end. The launderer is exploiting a gap not in the data but in the tooling and the coordination: the ledger of each chain remembers everything, but the memories live in separate books, and stitching them together is hard. Chain-hopping is a bet that the trail will die in the seams between the books faster than an investigator can sew them together.

3. Composability: The Wash Between the Hops

If chain-hopping supplies the discontinuities, DeFi's composability supplies the blur between them, and together they make the highway fast. Composability is the property that DeFi's building blocks — decentralized exchanges, lending pools, wrapping contracts, liquidity positions — can be plugged into one another freely, so that a single automated transaction can chain many operations together. For a legitimate user this enables sophisticated finance. For a launderer it enables an industrial wash.

Watch what happens on the far side of a hop. The stolen value can be swapped through a decentralized exchange into a different token, then wrapped into yet another form, then deposited into a liquidity pool and withdrawn as a mixed share, then split across dozens of fresh addresses — all in automated transactions, without a human intermediary, at the speed the blockchain confirms blocks. The DeFi assessment identifies the decentralized exchange as the typical first step precisely because it is non-custodial and often demands no identity: the launderer reshapes their holdings into hop-ready or harder-to-trace form without ever presenting a name. Where a traditional launderer needed shell companies and complicit bankers and weeks, the DeFi launderer chains primitives like commands in a script and runs the whole sequence in minutes.

So the modern laundering pipeline is chain-hopping and composability working as a pair: the hop breaks the trail across networks, and the composable swaps-and-splits multiply the transformations within each network, so that by the time the value has crossed three chains and passed through a dozen DeFi contracts on each, an investigator faces not one clean trail but a fan of thousands of transactions across multiple books. This is the register's LAUNDERED disposition in its most technologically advanced form. The goal is exactly the goal of the old-world launderer — put enough distance and complexity between the dirty origin and the clean cash-out that the link cannot be proven — but the tools are non-custodial, automated, global, and fast, and they were all built, originally, for entirely legitimate purposes.

4. The Same Road, Two Kinds of Traffic

It is worth pausing on the fact that everything in this case — the bridge, the DEX, the wrapping contract, the liquidity pool — was built for legitimate use, because that dual-use character is central to the disposition and to the difficulty of fighting it. A bridge is not a criminal tool; it is how a person legitimately moves their own assets from Ethereum to a cheaper chain. A decentralized exchange is not a laundering machine; it is how millions of people swap tokens without trusting a custodian. Composability is not an obfuscation technique; it is the design principle that makes DeFi powerful. The launderer did not build a criminal highway. They drove a criminal payload down the public one.

This matters because it shapes what can and cannot be done about it. You cannot simply ban bridges or DEXs without destroying the legitimate cross-chain economy, and — as Case 05's Tornado Cash saga showed — sanctioning the autonomous code itself runs into hard legal limits. The infrastructure is neutral; the same crossing carries a family relocating their savings to a cheaper chain and the Lazarus Group scattering a stolen bridge pool. The register states this plainly because the alternative — treating every cross-chain transaction as suspect — would criminalize the ordinary use of a technology by far more legitimate users than criminals, which is both unjust and futile.

The consequence is that the fight cannot be won by blocking the road; it has to be won by watching it. And that reframes the whole problem from prevention to visibility: since the illicit traffic cannot be stopped from using public infrastructure without stopping the legitimate traffic too, the answer is to make the illicit traffic followable across the infrastructure it shares with everyone else. That is exactly the contest playing out now — and it is one the launderer is, slowly, losing.

5. The Cameras Go Up

The register's founding paradox has the final word here, and it is turning against the chain-hopper. Recall the crucial fact from Section 2: chain-hopping does not delete the trail, it scatters it. Every hop is a permanent, public transaction on both the chain it left and the chain it entered. The discontinuity that protects the launderer lives entirely in the tools and the coordination — the fact that trackers were historically built one chain at a time — and not in the data, which is complete and permanent on every chain the money touched. That is a temporary advantage, and it is eroding.

Advanced cross-chain analytics now increasingly do the stitching the launderer was betting no one would do. A bridge deposit on chain A and a corresponding withdrawal on chain B can be matched by amount, by timing, by pattern — the wrapped mint on the far side is not a disappearance but a linkable event, if you are looking at both chains at once. As analytics firms build genuinely multi-chain capabilities, the seams between the books get sewn, and the fan of thousands of transactions across three chains resolves, with enough work, back into a single traceable path. The highway that was invisible because no one watched all of it at once is being fitted, lane by lane, with cameras.

This does not mean chain-hopping is beaten — it remains one of the most effective techniques available for slowing and complicating an investigation, buying time, raising the cost of tracing, and defeating under-resourced or single-chain investigators entirely. The register does not overstate the cameras: a determined launderer hopping across many chains through many composable transformations can still exhaust the patience and the budget of all but the best-equipped pursuers, and much laundered value does reach cash-out unrecovered. But the trajectory is clear and it favors the tracker. The advantage of chain-hopping was always that the ledgers were separate and no one read them together; the moment the readers go multi-chain, the permanence of every hop stops being the launderer's cover and becomes the investigator's map. The road remembers every car that drove it. Someone is finally reading all the cameras at once.

6. The counter-narrative, steelmanned

The strongest objection to this letter is that it takes the launderer's side of the technology story — treating bridges and DeFi as fundamentally laundering tools with a legitimate veneer — and it deserves a fair hearing.

The argument runs like this. Cross-chain bridges and composable DeFi are overwhelmingly used by ordinary people and legitimate protocols; framing them as 'the launderer's highway' brands a whole category of financial innovation by the behavior of a criminal minority, and invites exactly the overbroad crackdown the register elsewhere warns against. The 'cameras are going up' optimism, the argument continues, cuts against the register's own emphasis on how much value gets away: cross-chain analytics remain hard, under-resourced, and always a step behind new chains and new bridges, so leaning on 'the tools are catching up' risks the same false comfort the register condemns in the BEC kill chain. And the bridge-heist framing, the objection concludes, conflates two different problems — insecure bridge code that gets exploited, and laundering that uses bridges — in a way that muddies both: the exploits are a software-security failure, not a money-laundering story, and bolting them together overstates the criminality of the infrastructure.

The register grants the force of all of it and holds its ground. Yes, the infrastructure is overwhelmingly legitimate, and Section 4 exists precisely to say so — the road is public, the traffic is mostly lawful, and the register explicitly rejects banning the road as both unjust and futile; naming the criminal traffic is not condemning the highway. Yes, the cameras are imperfect and much value still gets away — the register says exactly that in Section 5, calling chain-hopping one of the most effective techniques available and warning against overstating the analytics; the claim is a trajectory, not a victory. And yes, the exploit and the laundering are distinct problems — but they are joined at the bridge by design, because the same pooled value that makes the bridge worth stealing from is what the thief must then chain-hop to launder, so following the money genuinely runs through both, and the register treats them as connected stages of one flow rather than one phenomenon. What the register will not concede is that the dual-use nature makes the laundering role unremarkable. Interoperability was built to let value flow freely between chains; that very freedom, colliding with trackers built one chain at a time, created a real and heavily-used laundering highway, and describing it honestly — neutral road, criminal payload, cameras rising — is not branding the technology. It is following the money down it.

7. Disposition — LAUNDERED

Case 11 followed the money sideways — across the seams between blockchains, over the bridges that connect the islands, through the composable swaps and splits that blur the trail between crossings. The bridge served the criminal economy twice: as the richest vault to rob, holding the whole pool of value that backs an ecosystem of wrapped assets, and as the highway to launder the proceeds, carrying stolen value from a watched chain to an unwatched one and fracturing its trail at every hop.

The disposition — the money's fate — is LAUNDERED. Not spent, not frozen, not vanished, but washed: run through chain-hop after chain-hop, reshaped by DEX swaps and wrapping and splits at machine speed, until the distance between the dirty origin and the clean cash-out is too complex to prove — the oldest goal of laundering, reached on a new road. And the road is genuinely effective, which the register does not minimize: chain-hopping defeats single-chain tools, exhausts under-resourced investigators, and carries much value all the way to cash-out unrecovered.

But hold the register's paradox, because it is turning here too. Chain-hopping never hides the money the way a mixer does; it scatters it across public ledgers that each remember everything, betting that no one reads all the books at once. That bet is expiring. As cross-chain analytics learn to match a deposit on one chain to a withdrawal on another, the permanence of every hop stops being the launderer's cover and becomes the investigator's map — the highway fills with cameras, lane by lane. The honeypot beneath these words watches attackers probe for a way through; the bridge is where they found a way across, from a chain that is watched to one that is not. The vectors do not lie: every hop is on-chain, on two chains, forever, and the only question was ever whether anyone would read them together. Judge the launderer who drove the stolen pool down the public highway. Then note the trajectory the register keeps insisting on — that the road remembers, that the readers are going multi-chain, and that the seam the launderer counted on is being sewn shut behind them.

Follow the Money continues. Case 11 disposition: LAUNDERED. Confidence: HIGH on the mechanism — chain-hopping is named explicitly as a laundering technique in the US Treasury DeFi risk assessment and FinCEN's ransomware analysis; the cross-chain bridge / DEX / composability laundering pipeline is described in the DeFi assessment; bridges as an exploited attack surface and the hop-count tracing problem are documented in the SoK on Decentralized Finance attacks (Zhou et al., arXiv:2208.13035). The Wormhole, Nomad, Harmony, and Ronin bridge exploits and their hundreds-of-millions scale are matters of public record, with the Ronin/DPRK link tying to Case 02; specific figures are characterized rather than pinned. The maturation of cross-chain analytics is presented as an assessed trajectory, not a solved problem, and the register explicitly warns against overstating it. The dual-use, mostly-legitimate nature of the infrastructure is centered. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the launderer, the highway, and the cameras going up along it.