Crypto Bridge Hacks: AML Red Flags Compliance Teams Must Know
Cross-chain bridge hacks have become one of the most productive attack vectors in crypto crime, and the laundering that follows is sophisticated enough to defeat standard transaction monitoring if compliance teams are not specifically prepared for it. For any firm using crypto accounting software to track digital asset flows, understanding how stolen bridge funds move through DEXs and mixers is no longer optional. It is a baseline AML competency.
Why Bridges Are Prime Targets
Cross-chain bridges allow users to move cryptoassets across different blockchain networks. A bridge connecting Ethereum, Binance Smart Chain, and Harmony, for instance, must hold large concentrations of locked tokens at any given moment to facilitate those transfers. That pooling of liquidity is exactly what makes bridges attractive to attackers: a single successful exploit can yield nine-figure hauls.
The scale of the problem
The Harmony Horizon bridge attack, which resulted in approximately $100 million in stolen cryptoassets, was far from an isolated incident. By the middle of 2022, cumulative criminal thefts from bridges for that year alone had already reached well into the billions, with bridge attacks accounting for two of the three largest crypto thefts recorded at the time. The pattern has continued since. Each successful hack deposits a fresh pool of illicit funds into the laundering pipeline.
The Laundering Playbook: Step by Step
Once attackers have control of stolen assets, their goal is to convert them into fiat currency through regulated venues and financial institutions. To reach that exit point, they must first obscure the funds' origin. Two techniques dominate the playbook: rapid token swapping through decentralised exchanges, and obfuscation through crypto mixers.
Step one: fast token swaps at DEXs
Speed matters for two reasons. First, some token issuers, particularly stablecoin operators, retain the technical ability to freeze or reverse transactions. Hackers who fail to swap their stolen stablecoins quickly risk having those transactions cancelled before they can convert the value. The KuCoin hack in 2020 demonstrated this vividly: because the attackers did not swap their tokens fast enough, the exchange was able to recover the majority of more than $280 million in stolen assets through issuer-level transaction reversals. That lesson has been absorbed. Attackers now prioritise near-instant token conversion as a first move.
Second, swapping tokens breaks the direct on-chain link between the hack address and any subsequent transfers. Decentralised exchanges are a natural vehicle for this because they execute swaps via smart contracts, require no KYC verification, take no custody of user funds, and typically offer broad token liquidity. Despite guidance from the Financial Action Task Force indicating that countries should apply AML obligations to DEX services, most platforms still do not conduct AML monitoring in practice. That regulatory gap is a material risk for compliance teams at downstream centralised exchanges and financial institutions.
What is important to understand from a compliance perspective is that DEX swaps do not erase the evidence. Because every swap is executed by a smart contract and recorded on the blockchain, the full transaction history, including the pre-swap origin wallet, remains publicly visible. Blockchain analytics tools can trace a "clean" token received from a DEX back through the swap record to its original source in a bridge hack wallet. The Axie Infinity Ronin Bridge attack illustrated this clearly: attackers moved stolen USDC to their own wallets, routed a portion through intermediary addresses, swapped it for Ethereum at a DEX, and then sent portions of that Ethereum toward centralised exchanges. Every leg of that journey was reconstructable on-chain.
Step two: mixing to sever the trail
After DEX swapping, or sometimes as an alternative to it, bridge hackers route funds through crypto mixers. A mixer pools cryptoassets from multiple users and redistributes different coins of equivalent value, so that the output cannot be straightforwardly linked to the input. Once funds pass through a mixer, a compliance team receiving those funds at a downstream VASP or financial institution will typically see only that they originated from a mixing service, not that they came from a specific hack.
Within days of the Harmony Horizon attack, for example, the perpetrators began routing stolen assets through a prominent Ethereum mixer. This has become standard behaviour: bridge hackers use mixers specifically because the obfuscation is reliable and most standard transaction screening does not flag mixer-origin funds with adequate sensitivity.
Blockchain analytics does still provide a partial defence here. While mixing interrupts the ability to trace funds to a specific theft event, it does not make the mixer origin itself invisible. A compliance team can identify that a customer has received funds from a mixing service and, where that receipt occurs shortly after a major bridge hack, treat it as a significant red flag warranting enhanced due diligence and, where appropriate, a suspicious activity report.
AML Red Flags: What Compliance Teams Should Be Screening
The laundering patterns described above translate into concrete screening parameters. Compliance teams at virtual asset service providers and financial institutions should be testing their transaction monitoring configurations against the following risk indicators.
DEX-origin fund flows near a known hack event
A customer deposit that traces back through one or more DEX swaps to a wallet flagged in connection with a bridge exploit is a high-priority alert. The key is that blockchain analytics must be configured to look beyond the immediate prior hop: a deposit that appears to come from a DEX address is not necessarily clean. The DEX may simply be one layer in a multi-hop laundering chain originating from a compromised bridge wallet.
Mixer-origin deposits with no plausible explanation
Unexplained, high-value, or frequent inbound transfers from known mixing services represent a red flag in any context. The risk is heightened when the timing correlates with a recently publicised bridge hack. Compliance policies should specify a review threshold and a timeframe. A customer who receives a large mixer-origin transfer within days or weeks of a significant hack event warrants investigation regardless of whether a direct on-chain link to the hack can be established.
Rapid sequential swaps across multiple tokens
Legitimate users rarely need to swap the same funds through three or four different tokens in rapid succession across multiple DEXs. A pattern of fast, multi-hop swaps is a laundering indicator in its own right, particularly when the end token is one with broad fiat off-ramp liquidity such as Ethereum or USDC.
Wrapped token complexity as a deliberate obscuring mechanism
Bridge hacks frequently involve wrapped tokens, which are representations of native assets on a different chain. Compliance teams should ensure their screening tools can trace wrapped token flows and are not treating a token wrap as a transaction endpoint. A wrapped asset is still the same underlying value, and its provenance must be assessed accordingly.
Practical Implications for Accounting and Audit Teams
The compliance dimension extends beyond transaction monitoring alone. Accounting teams at firms handling digital assets need to consider how bridge-hack-related flows affect their own records and audit obligations.
For B2B firms: accounting and audit exposure
Any firm whose digital asset custody or trading activity intersects with funds that later prove to be proceeds of a bridge hack faces potential asset freeze or seizure risk. From an accounting standpoint, the key question is whether your crypto accounting software can flag the provenance of incoming assets at the point of receipt. If a client books a digital asset receipt and that asset subsequently turns out to be linked to an exploit, the firm may need to reverse the entry, report the transaction, or cooperate with a law enforcement freeze order. Audit trails must be detailed enough to reconstruct the full transaction history on demand.
CFOs at treasury functions holding digital assets should also review their policies on accepting wrapped tokens and DEX-sourced funds. A policy that treats any DEX-origin transfer as automatically acceptable without provenance screening is difficult to defend under a risk-based AML framework. Firms operating under MiCA in the EU, or under equivalent VASP regimes globally, should verify that their transaction screening tools are calibrated to catch the multi-hop patterns described above.
For individual filers: what to know if you use bridges
If you legitimately use cross-chain bridges to move your own assets, the practical risk to an individual filer is not that you'll be suspected of laundering. The risk is that you may inadvertently receive or swap through a wallet that has been contaminated by hack-related funds somewhere upstream in the pool. If a centralised exchange you later use flags your deposit as mixer- or DEX-linked, you may face account suspension or a request for enhanced verification. Keeping detailed records of every bridge transaction, including the origin chain, destination chain, token types, and timestamps, is the best protection. Good digital asset accounting software that records these events at the time of the transaction is far more reliable than reconstructing the trail months later for a tax return or a compliance query.
What Firms Should Do Now
The practical steps are straightforward to state but require deliberate implementation.
Review your transaction screening configuration
Standard rule sets often do not look more than one or two hops back in a transaction chain. Bridge hack laundering typically involves three to five hops across DEXs, intermediate wallets, and mixers. Work with your blockchain analytics provider to ensure your risk scoring engine looks back far enough and that mixer-origin funds trigger alerts at appropriate thresholds.
Update your SAR filing triggers
Mixer-origin deposits near the date of a known bridge hack should be treated as a SAR consideration, even where a direct causal link cannot be established. Document your reasoning either way. Regulators expect to see a risk-based decision, not simply an absence of a match.
Cross-reference public hack databases
Several blockchain analytics providers and open-source repositories maintain lists of wallet addresses associated with known bridge hacks. Integrating these address lists into your screening workflow ensures that direct contacts with known hack wallets are caught immediately, before the laundering pipeline can further obscure the origin.
Train your compliance team on DeFi-specific typologies
DEX swaps and wrapped token flows are not covered by traditional AML training modules built around bank wire transfers and cash transactions. Compliance staff need to be able to read a basic transaction graph and understand what a multi-hop DEX laundering chain looks like. That literacy is now a functional requirement, not a specialist add-on.
Source: Elliptic
Frequently Asked Questions
What makes cross-chain bridges particularly vulnerable to hacks?
Bridges must hold large pools of locked cryptoassets to function. That concentration of value in a single smart contract or set of contracts makes them high-reward targets. A single exploit can yield far more than attacking multiple individual wallets, which is why criminal groups have systematically targeted bridges.
Why do hackers use DEXs immediately after a bridge attack?
Two reasons: to avoid stablecoin issuer freezes, which can reverse transactions if the attacker still holds the original token, and to break the on-chain link between the hack wallet and subsequent transfers. DEXs require no KYC, hold ample liquidity across many token pairs, and execute swaps automatically. They are a convenient first-step obfuscation tool.
Can blockchain analytics really trace funds through a DEX swap?
Yes. DEX swaps are executed by smart contracts that write the full transaction record to the blockchain. That means the pre-swap origin address and the post-swap destination are both visible. Blockchain analytics tools can reconstruct the link between a "clean" token received from a DEX and its pre-swap origin in a hack wallet.
What should a compliance team do if a customer receives mixer-origin funds near the time of a major bridge hack?
Treat it as a red flag requiring investigation. While mixing prevents direct attribution to a specific hack, the mixer origin itself is detectable. The compliance team should assess the customer's broader activity, request additional information if appropriate, and consider whether a suspicious activity report is warranted. The decision and its rationale should be documented regardless of the outcome.
How does this affect firms choosing crypto bookkeeping software?
Firms evaluating crypto bookkeeping software should confirm it can record the full provenance metadata of incoming digital assets, not just the amount and timestamp. If a receipt later turns out to be hack-linked, the firm needs a complete audit trail. Software that only captures the top-level transfer without recording origin chain, intermediate hops, or DEX involvement will leave gaps that are difficult and costly to fill retrospectively.