Cross-chain

Cross-chain describes moving value between different blockchains, often through an intermediate service that forms a bridge. Because the route then runs across multiple networks, it is less straightforward to follow in one go. Whether this is done on purpose cannot be read from the step itself.

What it may indicate

A route that jumps from one blockchain to another can be an indication that someone wants to make following harder, but it need not be so. Sometimes it is simply practical use. What it really is only emerges from investigation across the networks.

While following a flow of funds, the balance moves to another network through a bridge. The trail continues there, but it calls for investigation across multiple blockchains to complete the picture.

What does cross-chain mean?

Moving value between different blockchains, often through a bridge service. The route then runs across multiple networks.

Does cross-chain make tracing impossible?

Not impossible, but harder. Following the route requires investigation across multiple blockchains; what it means emerges from that wider picture.

Does cross-chain traffic make a route untraceable?

Usually not, but the certainty per link becomes smaller. A hop has to be substantiated separately. Where that is not possible, we name it as the limit of the investigation instead of extending the line.

Which details help with a cross-chain link?

The exact time, the amount before and after the hop, the name of the bridge service used and any reference codes the service returns. Screenshots of your own confirmation are valuable here.

Is cross-chain use a sign of fraud?

No. Many users move across chains for lower costs or to reach a particular application. Only in combination with other features can a hop be part of a pattern.

Where a route across chains becomes hard to follow

A transfer between two networks is not one transaction but two, joined by a service that holds or issues value in the middle. Reading such a step means matching an outgoing transaction on the first network to an incoming transaction on the second, using the amount, the moment and whatever reference the service leaves behind. When that service publishes its own records the match is straightforward, and when it does not the connection has to be argued rather than shown, which changes how firmly it can be stated in a report.

These crossing points are also where a lot goes wrong for other reasons. The services that make them possible hold large balances and have been attacked repeatedly, so a route may pass through one because a victim chose it or because an attacker emptied it. Distinguishing between those two situations matters for the conclusion, and it is usually possible by looking at whether the movement fits the pattern of ordinary user activity at that moment. We describe the crossing, the evidence for the match and the degree of certainty separately.

External sourceEuropol describes attacks on networks, services and infrastructure as a persistent threat in which attackers move quickly to convert access into value, often across borders. That framing helps to explain why the services that connect networks are a recurring target and why the aftermath of such an incident is visible on-chain long before it is confirmed publicly. See Europol: cyber attacks.

Your own situation

If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.

The first step is contact by phone. We prefer to schedule that call through WhatsApp, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.

Go to the contact form