Chain-hopping
A financial obfuscation technique that moves cryptocurrencies from one blockchain to another, conversion after conversion, to conceal the origin of illicit funds.
In March 2022 the Lazarus group stole about $625 million in ether and USDC from the Ronin bridge. The US Treasury established that the funds went through the Tornado Cash mixer, which it sanctioned on August 8, 2022. Chain-hopping means converting funds quickly and in sequence across several cryptocurrencies and blockchains, to break the traceability of flows and hide their criminal origin. An attacker paid a ransom in bitcoin can chain conversions this way: bitcoin to ether on a loosely regulated exchange, ether to monero to benefit from this privacy protocol's opacity, then back to bitcoin to recover liquidity. Other tools are at hand: peel chains (fractional withdrawals to many addresses, which dilute the trail), non-custodial mixers (services that blend funds from multiple users) and decentralized exchanges with no identity verification (KYC). Blockchain analytics firms such as Chainalysis and Elliptic reconstruct these trajectories with clustering and probability-tracking algorithms, but each conversion makes the tracing coarser. For cyber insurers, chain-hopping complicates OFAC screening before a ransom payment: several conversion layers can hide the ultimate beneficiary.
In 2021, the DarkSide group received the Colonial Pipeline ransom in bitcoin, then quickly converted part of the funds through a mixing service and several chain-hopping steps. The FBI still recovered about 2.3 million dollars by seizing the private key of an intermediate wallet: chain-hopping does not always hold up against high-quality forensic analysis.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.