Elliptic Report Finds Cross-Chain Crime Up 200 – Here’s Where Hackers Hide Now

Cross-chain criminal activity has soared to over $21 billion, according to new research from Elliptic, a leading digital asset risk management firm.

📣 New Elliptic report: The state of cross-chain crime 2025 🔄

Great news! Our latest report, The state of cross-chain crime 2025, is now available.

Cross-chain crime, the anonymous movement of illicit crypto through DEXs, cross-chain bridges and no-KYC swap services, has… pic.twitter.com/7jjIvE8NhB

— Elliptic (@elliptic) July 16, 2025

The figure marks a threefold increase from $7 billion in 2023, showing how criminals are taking advantage of decentralized financial tools to move and conceal stolen assets.

Elliptic’s 2025 Cross-Chain Crime Report outlines how criminals are increasingly using decentralized exchanges, cross-chain bridges, and token swap services to obscure the origin of funds linked to scams, hacks, and sanctioned entities.

The data points to a sharp rise in chain-hopping tactics, where bad actors rapidly move funds across multiple blockchains to make detection more difficult.

The report shows that 33% of crypto crime investigations now involve activity on more than three blockchains; 27% span over five, and one in five extends across ten or more.

Among the most high-profile incidents this year was the Bybit hack—the largest crypto heist on record—where stolen funds were rapidly laundered through multi-chain paths. Elliptic helped trace the assets and continues to support global investigations into the breach.

State-Backed Threats and Sanctioned Platforms

The report attributes around 12% of the total $21 billion to North Korean-linked activity, primarily driven by the Lazarus Group. These state-backed hackers have been at the forefront of using advanced chain obfuscation techniques, making the recovery of stolen assets increasingly complex.

Their tactics now include swift coin swaps across multiple chains and using anonymizing services to cash out funds. Elliptic also flagged $300 million in cross-chain transfers originating from Iranian crypto services currently under U.S. sectoral sanctions.

In Russia, the Garantex exchange—seized in March 2025 with the help of Elliptic’s data and the U.S. Secret Service—had been using cross-chain tools to hide fund flows and bypass international restrictions.

The company’s findings reflect how sanctioned nations are leaning on blockchain infrastructure to bypass traditional financial barriers. Beyond these cases, Elliptic identified a growing number of scams that operate in real-time and use cross-chain strategies to siphon money before authorities can react.

Platforms like CBEX, which stole nearly $1 billion from users while appearing legitimate, relied on this multi-chain laundering to stay operational while defrauding investors.

Scams, Rug Pulls, and Real-Time Laundering

The 2024–2025 memecoin boom created fertile ground for fraud. One example was the collapse of the $LIBRA token, which saw $100 million vanish in a rug pull just days after Argentine President Javier Milei tweeted support.

The endorsement sent prices soaring before the anonymous developers drained liquidity and disappeared.

Elliptic’s lead crypto threat researcher, Dr. Arda Akartuna, stressed that while criminals are using more complex methods, they are not beyond reach.

“Our ability to automatically trace transactions across 55 blockchains and over 300 bridge routes means we can follow the money, no matter how it moves,” he said.