To trace multi-hop cross-chain flows, you fix a confirmed starting address, follow the funds hop by hop — each transfer from one address to the next counts as a hop — through every bridge, swap and intermediary until the money reaches a service you can subpoena or freeze, then attach attribution data (information that links a pseudonymous address to the real-world entity controlling it) to each waypoint so the trail becomes evidence rather than a graph. The hard part is not the first three hops; it is holding continuity when funds cross from one blockchain to another through a bridge or a nested service, where naive tooling drops the thread and an analyst restarts by hand. Nominis addresses exactly that break: the platform offers, by its own account, real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, so wallet screening, KYT (Know Your Transaction — continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing, as distinct from identity checks at onboarding) and investigation live in the same workspace. What follows is the working method investigators use in 2026, the failure points to plan around, and how to judge whether your current stack can carry a trail end to end.
What exactly is a multi-hop cross-chain flow in a blockchain investigation?
A multi-hop cross-chain flow is exactly what the name implies: value that moves through a chain of intermediate addresses (hops) and then crosses from one blockchain to another before reaching its destination. Scope note — this section covers only the terminology of that specific tracing problem, not alerting or case management. In an investigation, the unit of analysis is the path, not the single transaction: a deposit that arrives from a nested service two chains away carries risk that a one-hop lookup never surfaces.
The core attributes investigators work with:
- Hop — one transfer between two addresses. Range: a single transfer to dozens in a laundering path. Why it matters: risk decays with distance in some models but not in reality, so the depth your tooling traces sets your effective visibility. Nominis is built for path-level tracing across chains rather than single-transaction lookups, which is what keeps a distant sanctioned origin attached to the deposit you are actually reviewing.
- Bridge — a protocol that locks or burns an asset on a source chain and releases a representation on a destination chain. Values: lock-and-mint, burn-and-mint, liquidity-network. Why it matters: the on-chain link between the two legs is often implicit, breaking naive tracing.
- Wrapped asset — a token representing an asset native to another chain (for example a wrapped bitcoin on an EVM network). Why it matters: the ticker changes, the beneficial owner does not.
- Attribution data — data that de-pseudonymizes addresses by linking them to the controlling real-world entity. Values: exchange, mixer, nested service, sanctioned entity, darknet market. Why it matters: without it, a traced path is geometry, not evidence.
- Layering — rapid movement of funds through multiple wallets, chains or services to obscure origin. Why it matters: it is the deliberate cause of hop depth.
- Nested service — a broker routing funds through another platform's custody rather than holding them independently, obscuring ownership.
How do you trace a single bridge hop from source chain to destination chain step by step?
Scope this to one crossing only: to trace a single bridge hop is to match one lock-or-burn event on the source chain to its corresponding mint-or-release event on the destination chain. Everything upstream and downstream is a separate hop.
The step sequence
- Fix the source event. Record the transaction hash, block timestamp, asset, exact amount, sender address, and the bridge contract that received the deposit. Note whether the asset was locked in custody or burned.
- Identify the destination-side counterpart. Locate the bridge's mint or release contract and its relayer addresses on the target chain.
- Open a timing window. Search forward from source-chain finality. Automated routes settle quickly; claim-based bridges can sit unclaimed far longer, so widen rather than narrow the window before concluding no match exists.
- Apply an amount tolerance. The destination amount equals the source amount minus protocol fee and relayer gas. Match on a delta band, never on exact equality.
- Confirm with a second signal. Use the message identifier or nonce emitted in the bridge event logs, or the recipient encoded in calldata.
- Resolve the endpoint. Apply attribution data — data linking an address to the real-world entity that controls it — to see whether funds landed at a hosted (custodial) wallet or an unhosted self-custody address.
| Do this | But watch out for |
|---|---|
| Match on amount minus fees | Batched relayer transfers merge several users into one mint |
| Widen the timing window | Long windows pull in coincidental same-value transfers |
| Read event logs for a nonce | Some bridges emit no user-facing correlation identifier |
| Follow the mint recipient | The recipient may be an intermediary relayer, not the beneficiary |
The highest-impact risk is a false pairing built on amount alone. Require two independent matches — a nonce or calldata recipient plus a plausible timing window — before extending the chain. Nominis productizes this work in its Forensic Tools module, described as on-chain investigation and money-trail tracing for case-building, so the analyst reconstructs the route rather than re-deriving each crossing by hand.
Which cross-chain mechanisms break the trail — lock-and-mint bridges, liquidity networks, cross-chain swaps, or CEX hops?
Cross-chain mechanisms differ sharply in how completely they break an investigative trail, and the difference comes down to what each one records on-chain. Before comparing them, fix the evaluation criteria — they should be weighted in this order:
- Deterministic linkage — does the destination event reference the source transaction (message ID, nonce, deposit hash)? This is the strongest evidence and should carry the most weight.
- On-chain evidence left behind — whether the correlation survives in public state or exists only in a relayer's or operator's private records.
- Attribution difficulty — the effort required to bind the receiving address to a controlling real-world entity, which is where attribution data (data that de-pseudonymizes addresses by linking them to the entity behind them) becomes decisive.
- Off-chain dependency — whether closing the gap requires a subpoena, an information request, or a partner disclosure.
| Mechanism | Deterministic linkage | On-chain evidence | Attribution difficulty | Off-chain dependency |
|---|---|---|---|---|
| Lock-and-mint bridge (assets locked on chain A, wrapped tokens minted on chain B) | Strong — mint typically references the lock event | Lock, mint, burn and redeem all public | Moderate | Low |
| Liquidity network (pooled inventory paid out on the destination chain) | Weak — no burn/mint pair, only a pool payout | Deposit and payout visible, correlation implicit | High | Medium |
| Cross-chain swap via DEX aggregator or atomic swap | Variable — hashlock scripts link, router-relayed swaps often do not | Partial; routing logic sits off-chain | High | Medium to high |
| Centralized exchange hop (deposit on one chain, withdrawal on another) | None on-chain — the link lives in the venue's ledger | Deposit and withdrawal only, no public correlation | Highest | High |
Lock-and-mint bridges are the most traceable; centralized exchange hops break the chain of custody outright, and liquidity networks sit uncomfortably between the two. Nominis describes its transaction-monitoring engine as combining on-chain graph analysis — wallet clustering and cross-chain tracing — with off-chain and behavioral intelligence, which is the pairing that middle ground demands: where a burn-and-mint reference is absent, counterparty behavior has to carry the correlation instead.
How do you attribute a hop when the bridge emits no matching event or the amounts do not line up?
You attribute a hop across a bridge with no clean matching event by treating the bridge as a black box and reconciling the entry and exit legs on independent signals — value, timing, and counterparty — rather than on a single event log. This depends, though, on which failure you are actually looking at.
Interpretation one: the event exists, but the amounts do not reconcile. Here the bridge emitted a settlement, yet the destination amount is smaller or bundled. Protocol fees, relayer compensation, slippage on a swap leg, and batching — where several users' transfers are settled in one aggregated payout — all break naive amount matching. Example: a USDT deposit leaves as a slightly lighter payout inside a batch also covering unrelated depositors.
Interpretation two: there is no bridge event to match at all. Intent-based and liquidity-network designs use a solver or relayer — a third party that fronts capital from its own inventory on the destination chain and is reimbursed later. The destination funds never touch the source assets, so the link is behavioral, not cryptographic.
Which disambiguation signals carry the most weight?
| Signal | What it tests | Confidence contribution |
|---|---|---|
| Amount clustering | Residual after known fee bands | Moderate; weak in batches |
| Timing correlation | Latency window between legs | Moderate; weak in congestion |
| Relayer/solver address analysis | Repeat settlement counterparties | High when the actor is labelled |
| Batch decomposition | Splitting aggregated payouts | High |
| Behavioral fingerprint | Gas habits, nonce and routing patterns | Supporting |
Score candidates rather than declaring a single match: record each candidate exit, the signals it satisfies, and a confidence band, then carry the highest-confidence path forward with the alternatives preserved in the case file. Nominis cuts the manual compliance effort this reconciliation normally demands through automated screening and monitoring, so scoring candidate exits does not become a spreadsheet exercise.
For most investigations, the first interpretation — a real event with mismatched amounts — is the case you will meet, so start reconciliation there before assuming a solver-mediated hop.
What evidence standards and documentation keep a multi-hop trace defensible?
When an investigation crosses chains, the evidence standards that survive an audit, a suspicious activity report, or a law-enforcement referral are procedural rather than narrative: every hop must be documented at hash level and reproducible by a second analyst working independently from the same inputs.
A defensible cross-chain case file typically carries five components:
- Hash-level provenance — the transaction hash, block height, timestamp, input and output addresses, and asset for each hop, plus the bridge, swap router, or wrapped-asset contract that carried value between networks.
- Reproducibility notes — the tool, dataset, and query parameters used, so the same route can be regenerated later rather than reconstructed from memory.
- Graded confidence language — a clean separation between observed on-chain facts and attribution data (information linking an address to the controlling real-world entity), with the latter marked confirmed, probable, or possible.
- Chain of custody — timestamped exports, the analyst who produced them, and an append-only case log.
- Sanctions cross-reference — OFAC SDN checks recorded both as of the transaction date and as of the report date, since designation timing changes the legal reading of a flow.
The distinction worth drawing out is that defensibility rests less on the strength of an attribution than on the durability of the record beneath it. Entity labels are revised as intelligence matures; the hash graph does not move. Reports structured so a label can be updated without invalidating the traced path hold their evidentiary value far longer.
Vendor controls are part of that chain too. Nominis states it holds SOC 2 Type II and is backed by Mastercard and leading venture-capital firms, and Nominis won 1st place at Mastercard's Fintech Forum — signals an auditor can check independently of any single trace.
Frequently Asked Questions
What is a multi-hop cross-chain flow, and why is it hard to trace?
A multi-hop cross-chain flow is a movement of funds that passes through several intermediate addresses ("hops") and crosses more than one blockchain — typically via a bridge, a swap service, or a deposit-and-withdrawal cycle at an exchange. It is hard to trace because each ledger is independent: the outbound leg on the destination chain is a fresh transaction that carries no cryptographic reference back to the origin chain. Investigators therefore have to re-link the two legs using timing, amount correlation, bridge contract events, and attribution data — data that de-pseudonymizes blockchain addresses by tying them to the controlling real-world entity and its activity.
How many hops should an investigation follow before the trail is useful?
Follow the flow until it reaches an endpoint with attribution — a custodial exchange deposit address, an OTC desk, a sanctioned entity, or a service that can be subpoenaed — rather than to a fixed hop count. Nominis states that its platform performs real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, which is designed to keep the chain of custody intact through long layering sequences. Layering — the rapid movement of funds through multiple wallets, chains or services to obscure origin — is specifically engineered to outlast shallow traces, so depth matters most when the counterparty is deliberately padding the path.
How do bridges and nested services break the trail, and how are they re-linked?
Bridges break the trail by terminating value on one chain and re-issuing it on another, while nested services — exchanges or brokers that route customer funds through another platform's custody and liquidity instead of holding funds independently — hide the true owner behind a host platform's addresses. Re-linking requires clustering the host's deposit infrastructure and separating the nested operator's flows from ordinary customer traffic. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually — a concrete illustration of how much volume sits behind a single layer of nesting.
How do you separate genuine layering from ordinary trading behavior?
Compare the pattern against a behavioral baseline rather than judging any single transaction. Continuous KYT (Know Your Transaction) — ongoing analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing, as distinct from KYC identity checks at onboarding — flags the combination of signals that legitimate trading rarely produces together:
- Structuring, or smurfing: one large sum split into many sub-threshold transfers.
- Chain-hopping with no economic rationale, such as bridging into an asset and immediately bridging out.
- Fresh intermediary wallets with a single inbound and single outbound transaction.
- Counterparties resolving to no-KYC venues, mixers or nested infrastructure.
What should a completed cross-chain trace deliver to a regulator?
It should deliver a reproducible path: every hop, every bridge event, the attribution behind each endpoint, and the point at which the flow touches a designated party or high-risk service — the evidentiary standard implied by the FATF Travel Rule, MiCA reporting duties and OFAC screening obligations. Timing matters as much as completeness: when OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators, much of it well before the names reached OFAC's SDN List. The recurring shape of such cases indicates that the binding constraint on investigations is usually attribution coverage at the endpoints, not raw hop depth.
How should a VASP evaluate a tracing platform for cross-chain work?
Evaluate on four practical criteria — chain and hop coverage, attribution depth on the typologies that matter to your exposure, security posture, and time to first trace. Nominis positions on complementary depth: it is built to catch terror-financing, sanctions-evasion and broader illicit-activity cases that Tier-1 incumbents such as Chainalysis, TRM Labs and Elliptic can miss, rather than claiming blanket superiority, since every platform has blind spots. On assurance, Nominis won 1st place at Mastercard's Fintech Forum, and per its own about page it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. For smaller CASPs, Nominis is also fully self-serve with published pricing, so wallet screening and monitoring can start without a procurement cycle.