Elliptic Reveals: Cross-Chain Laundering Has Milked About $21 Billion from Crypto Ecosystems

Blockchain sleuths uncover massive cross-chain money laundering operation draining billions from digital asset space.

The Scale of Digital Drainage

Cross-chain bridges become criminals' favorite playground—moving illicit funds across blockchain networks with alarming efficiency. These sophisticated laundering techniques exploit interoperability protocols designed for legitimate DeFi operations.

Tracking the Untraceable

Analytics firms now develop specialized tools to follow money trails across multiple chains. The cat-and-mouse game between blockchain investigators and money launderers intensifies as criminals adapt faster than regulators can legislate.

Traditional finance executives probably sipping champagne while reading this—after all, $21 billion barely covers their annual bonus pool.

Tactics used in pig butchering

Elliptic’s investigators found that scammers often pool victims’ deposits into self-hosted wallets used only to consolidate and MOVE funds. From there, the money goes through a series of transactions to hide its origin. It may also go through cross-chain links or payment processing services, making it look like the money is real.

A popular tactic involves using mule accounts at regulated crypto platforms. These accounts frequently share suspicious markers such as identical residential addresses, repeated IP logins, and patterns of transfers between accounts.

Photos sent in for compliance checks sometimes show workers working from call centers or warehouses that are known to be where pig-butchering businesses start. However, the study stresses that blockchain leaves clear records of transactions, unlike cash-based crime. This openness gives lawmakers and platforms new ways to spot fishy behavior, even as scammers get better at what they do.

Elliptic says that Cross-chain laundering has milked about $21 billion

Elliptic also warns that pig butchering is only one piece of a broader picture. The report also detailed how individuals facing official sanctions increasingly turn to stablecoins for cross-border transactions.

🥁The Typologies Report is here 🚨

Explore 5 key threats shaping crypto crime right now:

✅ AI-driven scams
✅ Pig butchering
✅ Stablecoin abuse by sanctioned actors
✅ Cartel-linked money laundering
✅ Cross-chain laundering

📥 Download here: https://t.co/tGZsENHAaV

If you… pic.twitter.com/yy8CXGNL0O

— Elliptic (@elliptic) September 25, 2025

For instance, Russian entities use A7A5, a rouble-pegged asset, to get around the rules. Also, Rostec, a defense conglomerate, has said it wants to launch its own token, RUBx, to settle transactions for military goods. 

“Unsurprisingly, sanctioned actors have now integrated stablecoins into their sanctions evasion schemes,” Elliptic said. These include cross-border transfers, direct payments for goods and services, and theft through cyberattacks.

In addition, cross-chain laundering, which is the movement of money between different blockchains to hide where it came from, has become an important part of illegal finance. According to  Elliptic, more than 20% of money laundering cases now involve 10 or more blockchains. 

Elliptic’s research shows that more than $21 billion has been laundered through decentralized exchanges and bridges. This is a fivefold increase since 2022. The report warns that “cross-chain activity is now a fully embedded feature of illicit activity in the crypto-asset ecosystem.”

The Lazarus Group in North Korea is responsible for over $2 billion in illegal cross-chain activity, or 12% of the total. These techniques are also used by fraudsters, drug dealers, and even networks that use children for sexual abuse.

Elliptic also warns that fraudsters are marketing “AI-powered trading bots” that, in reality, amount to so-called rug-pull scams. This is a type of fraud where the creators of a project suddenly withdraw all the funds invested by users, leaving them with worthless tokens, while hostile state actors are using AI to refine malware and ransomware.

If you're reading this, you’re already ahead. Stay there with our newsletter.