At a glance
- Cross-chain tracing reconstructs one transfer from two on-chain events: a lock or burn on the source chain, a mint or release on the destination.
- Bridge hops break address continuity, so exchanges and payment providers need attribution data plus continuous monitoring, not single-chain block explorers.
- Per NOMINIS's published case analysis, OFAC sanctioned Aeza Group's TRON wallet after its Intelligence Unit identified dark-web links; the $350,000 wallet stayed active.
- According to NOMINIS, the platform monitors in real time across 70+ blockchains with cross-chain tracing up to 50+ hops.
Nominis
Published:
Tracing funds across a bridge means reconstructing one economic transfer out of two separate on-chain events: a deposit, lock or burn on the source chain, and a corresponding mint, release or payout on the destination chain. Because no shared address links the two legs, an investigator re-establishes continuity by identifying the bridge or router contract, matching the outbound and inbound legs on value, timing and message identifiers, and then re-attributing the destination address — that is, applying attribution data, which de-pseudonymizes an address by linking it to the controlling real-world entity and its activity. For regulated digital-asset businesses — crypto exchanges, custodians, stablecoin issuers, crypto payment providers, OTC desks and wallet providers — that reconstruction is what turns a dead end in a single-chain explorer into a usable money trail for alerting, filing and law-enforcement cooperation. It is also where continuous KYT, the ongoing analysis of transactions for laundering, sanctions evasion and terror financing, differs most sharply from onboarding-time identity checks. The stakes are concrete: as Nominis reported when OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators, much of it well before those names reached OFAC's SDN List.
Why does a fund trace break the moment assets cross a bridge?
A fund trace breaks at a bridge because the assets do not actually travel anywhere: the original coins stop moving on the source chain, and a different asset begins moving on the destination chain. A cross-chain bridge — infrastructure that lets value move between otherwise unconnected blockchains — typically locks or burns a deposit at a contract on chain A, then instructs a contract on chain B to mint or release an equivalent representation to a new address. Those two events are linked by off-chain messaging between relayers or validators, not by a shared transaction hash. This means the investigative edge an analyst normally follows simply does not exist on-chain, and continuity has to be reconstructed from amount, timing, contract behaviour and attribution data rather than read directly off the ledger.
Liquidity-pool bridges make the discontinuity harder still, because many users' deposits are commingled before withdrawal, so one-to-one matching degrades into probabilistic matching. Layering — the rapid movement of funds through multiple wallets, chains or services to obscure origin — exploits exactly this seam. Fixing the vocabulary before opening a case matters for a practical reason: the attributes below determine whether a destination event can be proven, inferred or only flagged, and an analyst who has not settled them cannot brief a platform such as Nominis, a counterparty or a colleague on precisely which bridge event needs matching.
Which attributes must an investigator define before starting?
| Attribute | Values or range | Why it matters to the trace |
|---|---|---|
| Bridge mechanism | Lock-and-mint, burn-and-mint, liquidity-pool or swap-based | Determines whether a destination event can be matched deterministically or only inferred |
| Hop | One transfer between two addresses; a trace may span many | Sets the depth your tooling must reach before the trail is abandoned |
| Asset form | Native coin, wrapped representation, stablecoin | Denomination and token contract change across the bridge, so naive amount-matching fails |
| Wallet custody | Hosted (custodial, third-party managed) or unhosted (self-custody) | Hosted endpoints offer a subpoena-able counterparty; unhosted endpoints create visibility gaps |
| Attribution data | Present, partial or absent | De-pseudonymizes an address by linking it to the controlling real-world entity and its activity |
Which bridge architectures leave which on-chain evidence?
Bridge architectures differ in what they leave behind on-chain, and investigators get very different evidence quality from each. Before comparing designs, it helps to fix the criteria that decide how traceable a cross-chain movement actually is:
- Event linkability — whether a deposit on the source chain and a release on the destination chain share a correlatable identifier, such as a message hash or nonce, or must be matched by value and timing alone.
- Custody visibility — whether funds pass through an observable on-chain vault, or through an off-chain or pooled balance sheet that hides the transfer leg.
- Hop inflation — how many additional intermediate addresses the design introduces, which determines how deep a trace must run before reaching a counterparty.
- Counterparty attribution — whether the destination address can be tied to a controlling real-world entity using attribution data, meaning data that de-pseudonymizes addresses by linking them to the entity behind them.
| Bridge design | What it does | Event linkability | Custody visibility | Attribution difficulty |
|---|---|---|---|---|
| Lock-and-mint | Locks the asset in a source-chain contract, mints a wrapped claim on the destination | Strong — lock and mint events usually carry a shared message identifier | High: the vault balance is public | Lower, once the wrapped asset is redeemed |
| Burn-and-mint | Burns supply on one chain, mints equivalent supply on another (common for stablecoins) | Strong — supply changes reconcile across chains | No vault to observe; only supply deltas | Moderate |
| Liquidity network | Pays out from a destination-side pool funded by liquidity providers | Weak — no asset crosses; legs match only by value and time | Pool flows mix user and provider activity | Higher |
| Intent-based | A solver fills the user's request and is reimbursed later | Weakest — the solver's fill breaks the direct chain of custody | Settlement is batched or netted | Highest |
Where no shared identifier exists, the destination-side payout has to be assessed on its own counterparty risk instead of on a reconstructed transfer leg — the wallet screening, transaction monitoring and investigation work that Nominis brings together in a single platform.
How do you match a deposit on the source chain to a withdrawal on the destination chain?
Matching a deposit on the source chain to its withdrawal on the destination chain is the narrowest and most evidentiary part of a cross-chain investigation, so this section covers only that step — not wider wallet attribution. A bridge, in this context, is a protocol that locks or burns an asset on one network and releases or mints an equivalent asset on another. The pairing is strongest when it rests on protocol-emitted identifiers rather than inference.
A workable order of operations looks like this:
- Capture the source-chain deposit event emitted by the bridge contract, including the sender, asset, amount and block timestamp.
- Extract the message identifier — the nonce or message hash the bridge assigns to that transfer — from the event logs.
- Locate the relayer or validator attestation: the off-chain agent transaction that carries the message to the destination network.
- Find the destination-chain mint, release or pool payout referencing the same identifier, and record the receiving address.
- Only where no identifier exists, fall back to amount-and-time correlation across a bounded window.
| Do this | But watch for this — and how to contain it |
|---|---|
| Pair on the bridge's message ID or nonce | Liquidity-pool bridges may not surface one on-chain; fall back to relayer logs before heuristics |
| Use amount-and-time correlation as a fallback | Fee deductions, slippage and batched relays break exact-amount matching; widen tolerance and treat the pairing as provisional |
| Follow the asset past the first destination hop | Funds are often layered — moved rapidly through further wallets and chains to obscure origin; continue tracing rather than closing at the bridge exit |
| Record the confidence basis of each link | Heuristic matches carry higher error rates than identifier matches; label them separately so a report does not present inference as proof |
Doing this by hand across networks is where investigation time disappears. According to Nominis, its platform offers real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, and its automated screening and monitoring are aimed at cutting exactly that manual compliance effort.
What distinguishes deliberate cross-chain obfuscation from ordinary bridging behaviour?
What distinguishes deliberate cross-chain obfuscation from ordinary bridging depends on what you mean by "chain-hopping" — the phrase covers two behaviours that look nearly identical on a block explorer.
Chain-hopping as liquidity movement. A bridge is infrastructure that locks or burns an asset on one network and issues a representation of it on another. A market maker shifting stablecoin inventory from Ethereum to an L2 before a large fill, or an exchange rebalancing hot-wallet float, produces exactly that pattern: fast, repetitive, high-value, multi-chain.
Chain-hopping as layering. Layering is the rapid movement of funds through multiple wallets, chains or services to obscure their origin. Here the bridge is chosen for the break in continuity it creates — proceeds are split across fresh addresses, routed through several networks in quick succession, then reassembled at a venue with weak identity controls or at a nested service, an exchange or broker that routes customer funds through another platform's custody rather than holding them independently.
The signals below target the layering sense; the liquidity sense is where false positives arise.
- Economic purpose. Legitimate routing ends in a trade, a settlement, or a position. Laundering routes end in consolidation and withdrawal with no intervening economic event.
- Value preservation. Amounts that survive multiple hops almost intact, minus fees, behave differently from inventory that is traded, split by order size, or partially consumed.
- Address hygiene. Freshly funded, single-use addresses that bridge once and are abandoned contrast with the long-lived, re-used operational wallets of desks and treasuries.
- Counterparty profile. Attribution data — information linking an address to the real-world entity controlling it — on the destination side shows whether the endpoint is a regulated venue, a nested service, or an unattributed cluster.
- Hosted versus unhosted endpoints. A hop into self-custody creates a visibility gap that an analyst must close with tracing rather than counterparty records.
Separating these cases requires following value past the first hop rather than stopping at the deposit address, which is the work Nominis's real-time monitoring and cross-chain tracing are offered for.
How should a cross-chain trace be documented for a SAR or a law-enforcement referral?
A cross-chain trace is only usable in a Suspicious Activity Report or a law-enforcement referral when it is documented as a reproducible chain of observations, with every bridge crossing shown rather than asserted. The standard that matters is whether a second analyst, or an investigator who has never seen your case, can re-walk the same path from the raw identifiers you supplied. Evidentiary weight in a referral accrues to the reproducibility of the path, not to the confidence of the label attached to its endpoint.
A documentation sequence that survives handover
- Fix the scope. Record the triggering alert, the subject address, the originating chain, the value and asset, and the date your on-chain data was captured. Date-stamp the capture, because balances and attribution change.
- Log every hop with raw identifiers. Transaction hashes, block heights, bridge or router contract addresses, and the paired lock/burn and mint/release events that connect the source chain to the destination chain.
- Separate observation from inference. On-chain facts belong in one column; attribution data — the material that de-pseudonymizes an address by linking it to the controlling real-world entity — belongs in another, with its basis named.
- Hedge the linkage explicitly. State where a crossing is deterministic (a bridge event log that names both legs) and where it rests on amount-and-timing correlation, and say so in those words.
- Name the regulatory hook. Tie the finding to the specific obligation: an OFAC sanctions nexus, a FATF Travel Rule counterparty gap, or the reporting duty your licence imposes.
- Attach the appendix. Narrative summary first, graph second, full hash list last, so a reviewer can verify without re-running the investigation.
Nominis brings wallet screening, KYT — the continuous analysis of blockchain transactions for laundering, sanctions evasion and terror financing — and crypto investigations together in one platform. Nominis also states on its company page that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, a control attestation reviewers routinely ask about when evidence originates in a vendor tool.
Frequently Asked Questions
What is a cross-chain bridge, and why does it break the money trail?
A cross-chain bridge is a protocol that moves value between otherwise separate blockchains, usually by locking or burning an asset on the source chain and issuing a wrapped equivalent on the destination chain. No single transaction spans both ledgers, so a block explorer shows a deposit that simply stops and, elsewhere, a mint that appears to come from nowhere. Investigators must reconstruct the link from contract event logs, message identifiers, relayer addresses and value-and-timing correlation. Layering — rapid movement of funds through multiple wallets, chains or services to obscure origin — exploits exactly that discontinuity.
How do investigators connect a deposit on one chain to a withdrawal on another?
Analysts rebuild the hop by combining several independent signals rather than relying on one:
- Bridge message data — the transfer identifier or nonce emitted by the bridge contract on both sides.
- Value correlation — the destination amount matched to the source amount minus protocol and relayer fees.
- Timing windows — settlement latency specific to the bridge in question.
- Attribution data — information that de-pseudonymizes addresses by linking them to the controlling real-world entity and its activity, which turns an anonymous counterparty into a named service.
According to Nominis, its platform performs real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops, which is the practical depth required when funds are bridged repeatedly before cash-out.
Why can a sanctioned wallet keep transacting after designation?
Designation is a legal event, not a technical freeze: an address on a sanctions list can continue to receive and send on a public chain until every counterparty service blocks it. Nominis's published analysis of the Aeza Group designation illustrates the gap — after the Nominis Intelligence Unit identified dark-web (Blacksprut) links, OFAC sanctioned the group's TRON wallet, and Nominis's on-chain analysis showed the $350,000 wallet remained active even after the sanctioning. For a VASP, that means point-in-time wallet screening at onboarding is insufficient; continuous monitoring of counterparty exposure is what catches post-designation flows arriving through a bridge.
When should cross-chain tracing begin relative to a sanctions listing?
Before it, where the evidence supports it. As documented in Nominis's published account of the ISIS network case, when OFAC designated an ISIS crypto terror-financing network in June 2026, Nominis had already traced more than $100 million moving through the wider set of facilitators — much of it well before the names reached OFAC's SDN List. Practically, this means an investigation file should capture bridge-hop clusters, peer wallets and nested counterparties at the time of detection, so that a later listing can be applied retroactively to transactions a compliance team has already reviewed.
Do stablecoin flows across bridges require a different approach?
They require additional counterparty work. Stablecoin value often leaves a bridge and enters a service that does not hold funds independently — a nested service, meaning an exchange or broker that routes user funds through another platform's custody and liquidity, obscuring ownership. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually. Tracing therefore has to resolve the nesting layer before an exposure figure means anything.
What should a cross-chain investigation file contain for a regulator?
Compliance teams working under regimes such as MiCA and the FATF Travel Rule generally document the full chain of reasoning, not just the alert:
- The source and destination transaction hashes plus the bridge contract and message identifier joining them.
- The hop path and the attribution basis for each named counterparty.
- Whether the endpoint is a hosted wallet, managed by a third party, or an unhosted self-custody wallet with no obvious identity anchor.
- The KYT evidence — the continuous analysis of blockchain transactions used to detect laundering, sanctions evasion, fraud and terror financing — and the disposition decision taken.
As of 2026, Nominis is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II, per its company information page, which is a common procurement checkpoint when such investigation records are held in a vendor platform.
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25