Blog Post

Cross-Chain Bridge Tracing Demystified

February 6, 2025

Introduction

Guess which financial giant moves over $100 million daily and has over $54 billion in transaction volume since launch?

If you guessed Western Union, you’re close–they process roughly $220 million a day.

The real answer is the Wormhole bridge—one of the most popular cryptocurrency bridges, which effectively "teleports" (or transfers) crypto assets from one blockchain to another. It’s much like how Western Union sends money across borders but in the crypto realm.

In this blog, we’ll dive into how Wormhole works and, more broadly, how to investigate cross-chain bridges. From understanding the locking-and-minting mechanism to using blockchain explorers and smart contract intelligence platforms, you’ll discover practical steps for tracing funds across multiple networks—even when they traverse these increasingly popular (and sometimes exploited) bridging protocols.

Why Cross-Chain Bridges Matter

Cross-chain bridges are protocols that enable assets or tokens to be transferred (or “wrapped”) between blockchains, serving as a key component of blockchain interoperability. Wormhole is undoubtedly one of the most popular and, as of Jan. 1, 2025, boasts $54 billion in total transaction volume since its launch and over $100 million in daily asset transfers across 30 different blockchains.

Figure: Wormhole bridge statistics as of Jan. 1, 2025. Source: https://wormholescan.io/

Such high volume not only attracts attention from investors but also from regulators and law enforcement. The complexity of cross-chain fund flows introduces unique security, compliance, and investigative challenges.

Want a closer look at other emerging cross-chain threats and vulnerabilities?
Download our latest Web3 Risk Report for an in-depth analysis of how malicious actors exploit bridging protocols—and how investigators can respond.

Cross-Chain Transfers on Wormhole

The chart below illustrates how tokens have moved through Wormhole over the past 365 days. Ethereum dominates as the primary source blockchain—accounting for more than 50% ($7B) of all bridge activities. Solana and Sui emerge as top destinations, capturing nearly 50% ($3.7B) and 35% ($2.6B) of the bridged volume, respectively. Other chains like Arbitrum, BSC, and Base receive smaller, yet still significant portions, reflecting a growing multi-chain ecosystem.

Figure: Cross-chain transfer volume, Wormholescan

Wormhole usage skyrocketed in early 2023 and continued to trend upward, culminating in another major spike in October 2024.

Figure: Monthly Transactions of Wormhole Bridge on Ethereum Blockchain

As is the case of Railgun, the mechanisms underpinning these cross-chain transactions rely heavily on smart contracts that lock, mint, and verify assets as they move between chains. In the Wormhole ecosystem, the Ethereum Core Bridge smart contract ensures secure and seamless transfers between Ethereum and other networks. This contract acts as an intermediary by:

Verifying transaction data
Recording token movements
Ensuring that assets are properly wrapped and unwrapped

For investigators, smart contract intelligence platforms such as AnChain.AI SCREEN™ make it simpler to understand how these contracts function—an invaluable aid in tracing illicit or suspicious transactions.

Figure: Screenshot of SCREEN™ Analysis of the Wormhole Ethereum Core Bridge smart contract

Unsurprisingly, Wormhole has also drawn the attention of hackers and ransomware groups—such as the Raydium Pool and CashioApp exploiters—who have used the bridge to move stolen funds.

Figure: AnChain.AI’s risk scoring flagged this address with a 95 (high-risk) rating due to extensive transactions with hacker and ransomware wallets.

How To Conduct Investigations Through Cross-Chain Bridges

Tracking assets across different blockchains can be challenging, especially when they move through cross-chain bridges. However, by understanding the process and using the right investigative tools, you can follow assets across multiple networks. Below is a structured approach:

1. Understanding How Cross-Chain Bridges Work

A cross-chain bridge allows tokens to transfer between two blockchains. Typically, the original token on the source blockchain is locked, and a corresponding wrapped version is created on the destination blockchain. For example, if you send ETH from the Ethereum network to the Binance Smart Chain (BSC) via a bridge, the ETH on Ethereum is locked, and an equivalent amount of “wrapped ETH” is minted on BSC.‍

Example: Ethereum to Binance Smart Chain(BSC) via Wormhole Bridge

Reference Transaction (WormholeScan): https://wormholescan.io/#/tx/0xd5edc47aa6401ab6ed4d9c8c1d640103e81ab0176a28dd5471f62b9987156d40

‍Step 1: Initiate the Transaction on Ethereum

Sender: 0x48DF9E8DeaeFEc5E7438dc5Ed8b8f22c3ea79299
Action: Transfers USDT to the Wormhole: Portal Token Bridge address on Ethereum.
Ethereum Transaction Hash: 0xd5edc47aa6401ab6ed4d9c8c1d640103e81ab0176a28dd5471f62b9987156d40
Portal: 0x4db1683d60e0a933a9a477a19fa32f472bb9d06e
Wormhole: Portal Token Bridge address: 0x3ee18b2214aff97000d974cf647e7c347e8fa585
Details:
- Transfer 550 USDT from Ethereum to the Portal
- The Portal then transfers 550 USDT to the Wormhole: Portal Token Bridge address and records the sequence and chainId of the target chain using the event PortalSwapStart.
- The “Wormhole: Portal Token Bridge” passes this transaction information to “Wormhole: Ethereum Core Bridge”, which records the transaction details.

Step 2: Transaction Verification on BSC

BSC Transaction Hash: 0x2d30d5cbb03e38fdadddfabc5af9cbcabf29531873ebf2ff461f76eba6a33693
Portal Contract Address: 0xd123f70AE324d34A9E76b67a27bf77593bA8749f
PancakeV3Pool address: 0x4024581A5a528b21C3cBb98a951A6a134a91Dc3d
Action:
- An equivalent amount of Wormhole USDT is minted and sent to the user’s BSC address.
- The user then exchanges the equivalent Binance Pegged USD through PancakeV3Pool
Verification: Compare the transaction on Ethereum with the mint event on BSC by:
- Matching the amount, sender address, and destination address.
- Checking the PortalSwapStart event on Ethereum and TransferRedeemed event on BSC, ensuring they correspond.

Key point: Bridges don’t directly move the original token; they lock it on the source chain and create a wrapped version on the target chain. Tracking these wrapped assets is critical for any investigation.

2. Identify the Bridge Used and Track Lock/Mint Events

When tracing funds across blockchains, identify:

Source Blockchain: Find the bridge’s address and locate the transaction in which the funds were sent to the bridge’s smart contract. This is often called the “lock” transaction–most bridges will publicly display this.
Target Blockchain: Look for the corresponding transaction in which the wrapped token was minted or released. This will often be linked with the recipient address specified in the original transaction.

Since each bridge may operate differently (e.g., Wormhole, Anyswap, or Synapse) and have unique ways of handling these transactions, it can be helpful to consult the bridge’s official explorer or documentation.

3. Monitor Bridge-Specific Contracts

Each bridge has unique smart contracts for managing assets. To track transactions effectively, you’ll need to track both the source and destination contracts:

Look for specific contract addresses associated with bridge protocols on each blockchain. These can usually be found in the bridge’s official documentation or block explorer profiles.
Use blockchain explorers like Etherscan (for Ethereum) or BscScan (for BSC) to examine the transaction history of these contracts.

Figure: Overview of mainstream cross-chain bridges–what chains it supports and example contract addresses.

Cross-chain bridges frequently update their contract addresses and security features. Investigators can stay informed by:

Official Documentation & GitHub – Always check the bridge protocol’s official documentation or GitHub repositories, where updated contract addresses are regularly published.
Blockchain Explorers – Use explorers like Etherscan, BscScan, or Polygonscan to look up contract addresses by protocol name, as verified and tagged addresses are often listed.
Bridge Interfaces – When interacting with a bridge through its official interface, contract addresses are typically embedded within the platform, minimizing the risk of engaging with unofficial or fraudulent contracts.

4. Track Wrapped Token Movements on the Target Chain

Once the wrapped token is minted on the destination chain, it functions like any other token on that blockchain. You can follow its path using the same methods you would use to track native tokens:

Use transaction history on the new chain to see how the wrapped token moves between addresses.
If the tokens are split or combined in different wallets, you can continue tracing them just like standard token transfers.
If the token moves to multiple addresses, it can be helpful to follow these transactions on the target chain to track its dispersal or aggregation at a new wallet.

5. Link and Match Source and Destination Transactions

To confirm you’re tracking the correct cross-chain transfer:

Match exact token transaction amounts, timestamps, and addresses from the source blockchain to the events on the destination blockchain.
Look for unique identifiers (e.g., transaction IDs or nonce values) to link the original transactions to their cross-chain equivalents.
Be aware that some bridges may match multiple transactions together. In such cases, you might need to dissect several grouped transfers to find the specific one you’re tracing.

6. Stay Updated on Bridge Protocols

Cross-chain bridges evolve rapidly. New privacy features or transaction patterns can make investigations more challenging. Keeping up to date on these changes is essential for tracking future cross-chain transfers. While a combination of blockchain explorers, cross-chain analysis tools, and meticulous manual tracking often enables investigators to trace assets across different blockchains, anonymity, and privacy layers in some protocols may still obscure the full flow of funds.

Conclusion: The Importance of Cross-Chain Investigative Capabilities

Cross-chain transactions introduce a $54 billion challenge to an already complex investigative landscape. Criminals have laundered billions of dollars through cross-chain bridges since 2020, fully aware that moving funds across multiple networks can complicate investigations.

However, advanced cross-chain analysis tools—such as AnChain.AI CISO and SCREEN—are changing the game. Modern investigators can now trace illicit transactions across multiple blockchains with greater speed and accuracy, from initial bridging to final laundering attempts. A rapid, coordinated response is vital for disrupting criminal financial activity, and AnChain.AI is committed to building tools that empower investigators to flag and freeze suspicious funds moving through cross-chain bridges.

‍Looking to transform your investigations? Speak with one of our experts today at anchain.ai/demo, and don’t forget to download our Web3 Risk Report for even more actionable insights into the cross-chain threat landscape.