Crypto Sleuth ZachXBT Warns: Surging Bridge Volumes May Mask Illicit Money Flows

Cross-chain bridges are booming—but not all that liquidity is legit. Blockchain investigator ZachXBT flags a worrying trend: hackers could be exploiting inflated bridge volumes to launder stolen funds.

While decentralized bridges promise seamless interoperability, their lack of KYC creates perfect cover for bad actors. Just another day in the wild west of crypto finance—where the ’innovators’ move fast, and regulators clean up the mess.

ZachXBT points to DPRK activity on bridges

ZachXBT believes sudden peak volumes can signal the involvement of DPRK hackers trying to launder funds. The Bybit hack has still been a source of traffic for bridges, which caused increased chain-hopping to evade address screening. 

In the case of the LiFi bridge, ZachXBT estimates 15-25% of the activity may be due to the involvement of DPRK hackers. LiFi also works as a bridge aggregator, aiming to offer seamless cross-chain swaps. 

Previously, bridge activity was sometimes due to incentives or airdrop farming. Some chains have generally higher bridging activity, due to their active DeFi sector. Bridging is often a way to cash out of a protocol or a DeFi exchange. 

Bridges are among the most vulnerable smart contracts, often leading to sizeable attacks and the draining of funds. 

Bridge volumes have increased in the past month

The investigations of ZachXBT coincide with a general growth in bridge volumes for the past month. Bridges remain key for the ecosystem, most often for moving funds between Ethereum and L2 chains. 

Over $880M goes through various bridges daily, with most of the volume concentrated on top apps. Arbitrum saw the biggest bridging volumes in the past month, for a total of $2.77B. 

However, small bridges are also raising red flags for sudden spikes in volumes. Some of the bridges handle very low volumes, hence any deposit is a significant gain. For others, like the Hyperliquid bridge, activity is linked to increased demand for the underlying app. 

LayerZero, the leading bridge as of May 2025, also increased its net volumes in the past month, with significant daily spikes. Bridge activity also grows based on DEX demand and attempts to introduce cross-chain tokens.

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot