The Short Answer: Cross-Chain Tracing Is Doable but Not Trivial
Tracing stolen crypto funds across chains is a five-step workflow, not a single lookup: locate the attack address, expand outgoing transfers hop by hop, identify intermediate and consolidation addresses, trace across chains, find the exit. Cross-chain tracing is doable, but it is not trivial. When funds are stolen, the attacker almost never leaves them sitting in the original address. The money is swapped, split, and moved across chains to blur the path before it reaches a cash-out point.
The hard part is that the path runs through deliberate breaks. A DEX swap changes the token. A bridge moves the value to another chain. A mixer such as Tornado Cash cuts the link between a deposit and a withdrawal. Each of those breaks looks like a dead end to a naive tracer. A swap replaces the stolen token with a different asset. A bridge sends the value to a new chain with a new address set. A mixer pools funds from many users and returns them through fresh addresses, so the deposit and the withdrawal no longer share an obvious connection. Cross-chain tracing is therefore a workflow, not a query.
Why Stolen Funds Cross Chains
Attackers move stolen funds across chains for one reason: every hop buys distance from the original theft. A cross-chain hop also changes the data an investigator has to stitch together. Tracing within one chain means following one token through one graph. Tracing across chains means matching value across separate ledgers that do not share a single address book. The attacker exploits exactly that seam. Each new chain also resets the on-chain labels an investigator relies on, so the trail has to be rebuilt from the bridge's exit address.
The mechanics are visible in real incidents. In the Ronin Bridge theft, the attacker took 173,600 ETH and 25.5 million USDC, then routed the USDC through intermediate addresses and swaps to convert it into ETH before consolidating. In the Li.Fi attack, the attacker drained about $11.6 million in stablecoins and swapped them almost entirely to ETH through DEXs. More than 99% of the stolen funds eventually entered Tornado Cash through 114 transactions. The pattern is consistent: swap into a liquid asset, hop across chains, and exit through a mixer or an unregulated venue. Hops like these are among the FATF red-flag indicators for virtual assets.
These figures are documented on-chain analysis results, not a measure of any tool's tracking accuracy. They show that the cross-chain detour is a standard move, which means the response has to be a standard workflow rather than an ad hoc search. A responder who chases the thief chain by chain, without a plan, gets outrun by an attacker who already rehearsed the route.
The Five-Step Tracing Workflow
A careful cross-chain trace follows five steps: locate the attack address, expand outgoing transfers hop by hop, identify intermediate and consolidation addresses, trace across chains, and locate the final exit.
Step one: locate the attack address. Start from the theft transaction or the victim's report and pin down the address that first received the stolen funds. This is not always a single address. In the Nomad Bridge incident, 322 addresses moved about $190 million across 962 transactions and 14 assets, and clustering collapsed that surface into a much smaller number of real entities.
Step two: expand outgoing transfers hop by hop. From the attack address, expand each outgoing transfer to see where the value went next, then repeat for every downstream address. This is where the multi-hop path becomes visible instead of stopping at the first hop.
Step three: identify intermediate and consolidation addresses. As the path fans out, watch for addresses that receive from many sources and send to one place. These consolidation points are where an attacker reassembles split funds, and they are the addresses worth labeling and watching.
Step four: trace across chains. When value reaches a bridge or a wrapped-asset address, switch to the destination chain and continue from the receiving address. The chain boundary is where naive traces stop, and a cross-chain view is what carries the trail across it.
Step five: locate the final exit. Follow the funds until they land at an exchange deposit address, a mixer, or an off-ramp service. That exit is the endpoint an investigator reports, and it is the point where tracing hands off to an exchange or a law-enforcement partner. The US reporting mechanics sit with FinCEN.
The five steps are a loop rather than a straight line. A single trace can cross several chains and pass through dozens of intermediate addresses before it reaches an exit.
How MetaSleuth Makes It Tractable
The workflow is straightforward to describe and hard to execute by hand, because each hop multiplies the addresses an investigator has to review. This is what MetaSleuth does. MetaSleuth's Expand Outgoing feature expands a transaction's outgoing transfers hop by hop. An investigator follows the stolen funds forward from the attack address through each intermediate hop instead of reconstructing the path manually. Its cross-chain analysis carries the trace across chain boundaries, and its address labels annotate each hop with the entity name behind it.
MetaSleuth holds more than 600 million address labels, which is what turns a raw address into a named exchange, mixer, or service. Its real-time monitoring keeps watching stolen funds after the initial trace, so movement that happens days later surfaces as it occurs. For chain coverage, MetaSleuth supports 12 chains listed in its official documentation, with cross-chain tracing that follows value through bridges.
Together, these features turn the five-step workflow from a manual reconstruction into a guided pass: expand, label, cross chains, and monitor, all in one canvas. The investigator stays oriented while the attacker tries to get lost.
What to Do Next
If you are responding to a theft, start the trace while the path is still warm. Pick the attack address, expand its outgoing transfers, and follow the funds across every chain boundary until they reach an exit. The earlier the trace starts, the fewer hops the attacker has added since. Freeze the addresses you find so you can keep watching them after the first pass.
Trace stolen funds with MetaSleuth, and walk the five-step workflow on a real incident in minutes instead of reconstructing it by hand.
This piece is part of the MetaSleuth investigations and forensics guide, where the tracing method, evidence handling, and tooling tiers are covered end to end.