The illicit landscape of cryptocurrency has undergone a significant transformation in early 2025, with cybercriminals increasingly shunning traditional crypto “mixers” in favor of cross-chain bridges for laundering stolen funds. This shift marks a concerning acceleration in the speed and sophistication of digital asset crime, presenting formidable challenges for law enforcement and regulators globally.
According to a recent report by Global Ledger, shared exclusively with crypto.news, the first half of 2025 has been a devastating period for the crypto industry. Over $3.000.000.000 was stolen across 119 separate incidents, a staggering figure that already surpasses the total losses for all of 2024 by more than 50,0%. The alarming aspect is not just the volume, but the unprecedented speed at which these stolen assets are being laundered, often before the theft is even publicly disclosed.
The Rise of Cross-Chain Bridges in Illicit Finance
Cross-chain bridges, designed to facilitate the seamless transfer of assets between different blockchain networks, have emerged as the preferred tool for obfuscating the origin of stolen cryptocurrencies. In the first six months of 2025, an astonishing $1.500.000.000, representing 50,1% of all hacked assets, was routed through these bridges. This significantly overshadows the $339.000.000 (around 11,0%) sent to crypto mixers like Tornado Cash, which historically were the go-to for anonymity.
Analysts attribute this pivot to several key factors: the inherent speed of cross-chain transactions, the vast liquidity pools accessible across multiple networks, and potentially a lighter regulatory scrutiny compared to the heavily targeted mixers. While mixers blend funds to obscure their origin, bridges allow for rapid movement of assets across distinct blockchain ecosystems, making tracing efforts considerably more complex and time-consuming.
Hackers laundered 4.4x more via bridges than mixers in H1’25 | Source: Global Ledger-crypto.news
From Theft to Obscurity: A Blink-of-an-Eye Operation
The report highlights the alarming speed of these operations. In one instance, the fastest movement of hacked funds occurred in a mere four seconds. Furthermore, nearly one in four hacks saw funds fully laundered before any public disclosure of the incident, effectively closing the window for intervention. The swiftest complete laundering process—from initial theft to the final deposit—was recorded at just two minutes and 57 seconds. This “lightning-fast” approach severely limits the effectiveness of current alerting systems and recovery efforts.
Despite the growth of Decentralized Finance (DeFi) platforms, centralized exchanges (CEX) remain the primary off-ramps for converting stolen crypto into fiat currency or less traceable assets. Approximately 15,0% of hacked funds, amounting to $453.000.000, flowed into centralized exchanges, which are highly likely points for cash-out. In contrast, DeFi platforms received only about a third of that amount, roughly $170.000.000 (5,6%).
Recovery rates remain low. While enforcement actions led to $379.000.000 (nearly 13,0%) being frozen or burnt, only $140.000.000 (4,6%) was voluntarily returned by hackers. A substantial $1.600.000.000 (53,6% of total losses) remains unspent, likely held by attackers who are waiting for “the heat to die down” before attempting further laundering.
The increasing reliance on cross-chain bridges by cybercriminals underscores the urgent need for enhanced cross-chain security measures and collaborative efforts between blockchain analytics firms, exchanges, and regulatory bodies. As attackers continue to innovate, the industry must adapt swiftly to protect digital assets and maintain trust in the evolving financial landscape.
You might be interested in:
