Can stolen crypto be traced after a mixer or a cross-chain bridge?

Bridges: usually traceable

A bridge locks or burns tokens on one chain and releases equivalent tokens on another. The two operations are recorded on both chains and can usually be matched through the bridge's own data, amounts and timing. Instant swap services that convert between chains work similarly, and some of them are centralised companies that can receive freeze requests.

Repeated hops across several chains make the work longer, not impossible.

Mixers and CoinJoin: the link is broken

A mixer pools funds from many users and pays out to new addresses, so there is no direct transaction between what went in and what came out. Analysts use heuristics to estimate the most likely outputs.

• Matching amounts, after deducting typical fees.
• Timing between deposits and withdrawals.
• Behaviour after the mix, such as consolidating outputs or reusing addresses.
• Links to addresses already connected to the same actor.

Why the level of certainty matters

A good report distinguishes links that are certain (a direct transaction) from links that are probable (a heuristic match). Prosecutors, courts and exchanges need to know which is which. Overstating a probabilistic link can weaken the whole case; stating it correctly still gives the authorities a lead to follow.

Where action is still possible

Laundered funds eventually need an exit, usually an exchange or a broker. Many regulated exchanges screen incoming funds for links to mixers and can hold them. Watching the addresses that come out of a mixer or bridge, and alerting the likely exit points, often matters more than solving every hop.

How Advisorn helps

Advisorn Forensics follows funds across bridges and through mixers, states the confidence level of each link in the report, and sends requests to the exit points we identify.