Major cryptocurrency security incidents, like the 2025 Bybit hack, 2026 Bitget hack, and most recently the largest $6.3b Binance hack, demonstrate how stolen assets can move through multiple blockchain networks after an initial theft. For traders, investors, blockchain analysts, law enforcement, and anyone assessing digital-asset security or compliance risk, these cases show why on-chain investigations are rarely as simple as following a single wallet.
This article examines how stolen crypto moves through DeFi infrastructure, including cross-chain protocols, privacy tools and other techniques investigators use to trace funds across chains. It also explains the difference between legitimate protocol use and evidence of illicit activity, so readers can better interpret hack reports, custody risks, and the real limits of blockchain transparency.
Importantly, the movement of stolen funds through a protocol does not, by itself, establish that its developers, operators, or users knowingly participated in illegal activity.
Key Takeaways
-
Stolen cryptocurrency can move through multiple blockchains, wallets, decentralized exchanges, and privacy services, making investigations more complicated.
-
Privacy protocols and cryptocurrency mixers can reduce the visibility of transaction relationships, although their privacy mechanisms differ.
-
The 2025 Bybit and 2026 Bitget incidents provide documented examples of stolen funds moving through decentralized infrastructure.
-
Public blockchain records can support investigations, but identifying the individuals controlling wallets often requires additional evidence.
-
The use of a decentralized protocol in an illicit transaction does not automatically mean the protocol itself was compromised or complicit.
How Does Stolen Cryptocurrency Move Across Blockchains?
After a cryptocurrency theft, the stolen assets may initially appear in one or more blockchain addresses controlled by the attacker.
On transparent blockchains such as Ethereum and Bitcoin, investigators can examine transaction records to identify where assets were transferred.
However, the relationship between transactions becomes more difficult to establish when funds move through different networks or are exchanged for other cryptocurrencies.
Several types of blockchain infrastructure may appear in these investigations.
| Infrastructure |
Primary Function |
Relevance to Blockchain Investigations |
| Cryptocurrency wallets |
Store and transfer digital assets |
Funds can be distributed among multiple addresses |
| Decentralized exchanges (DEXs) |
Enable cryptocurrency trading through smart contracts |
Stolen assets may be exchanged for other tokens |
| Cross-chain swap protocols |
Exchange assets between different blockchains |
Investigators must connect transactions across separate networks |
| Blockchain bridges |
Transfer or represent assets across supported networks |
Transaction trails extend across multiple chains |
| Privacy protocols |
Provide transaction privacy through cryptographic mechanisms |
Some transaction relationships may no longer be publicly visible |
| Cryptocurrency mixers |
Reduce the observable connection between deposits and withdrawals |
Tumblers obscure the origins of funds and make attribution harder |
These services perform different technical functions and have legitimate applications.
For example, a user might use a cross-chain bridge to move assets from Ethereum to Arbitrum, or a decentralized exchange to trade tokens without transferring custody to a centralized exchange.
The same infrastructure can also appear in investigations involving stolen cryptocurrency. In scams, fraudsters exploit the difficulty of reversing confirmed transfers to take victims’ money.
Why Do Cross-Chain Transactions Complicate Investigations?
Each blockchain maintains its own transaction history.
A transfer on Ethereum does not automatically produce a complete record of a corresponding transaction on Bitcoin.
Investigators must therefore examine records from both networks and identify the relationship between the outgoing and incoming transactions.
Depending on the protocol, this may involve analyzing transaction identifiers, smart contract events, swap records, destination addresses, and timing information.
Cross-chain transactions are not necessarily anonymous. Some protocols publish sufficient information to connect transactions across networks.
However, tracing becomes more challenging when assets pass through numerous wallets and services or when transaction privacy mechanisms conceal relevant information.
Which Protocols Have Appeared in Investigations of Stolen Exchange Funds Recently?
Several decentralized protocols and cryptocurrency services have been identified in publicly documented investigations of major exchange security incidents.
| Protocol or Service |
Category |
Primary Function |
Documented Incident |
Reported Involvement |
| THORChain |
Cross-chain liquidity protocol |
Enables swaps between native assets on supported blockchains |
Bybit 2025; Bitget 2026 |
Investigators traced stolen assets through cross-chain swaps |
| Chainflip |
Cross-chain swap protocol |
Facilitates asset exchanges across supported networks |
Bitget 2026 |
Bitquery identified swaps and liquidity-account activity involving stolen assets |
| Stargate |
Cross-chain bridge |
Enables transfers between supported blockchain networks |
Bitget 2026 |
Bitquery traced stolen assets through Stargate transfers |
| Across |
Cross-chain bridge |
Facilitates cross-chain transfers |
Bitget 2026 |
Bitquery identified transfers involving stolen assets |
| deBridge |
Cross-chain interoperability protocol |
Supports transfers and cross-chain interactions |
Bitget 2026 |
Identified among the services appearing in Bitquery’s transaction analysis |
| eXch |
Cryptocurrency exchange service |
Provided cryptocurrency exchange services |
Bybit 2025 |
Elliptic linked the service to the movement of stolen funds |
| Tornado Cash |
Cryptocurrency privacy protocol |
Provides privacy for supported on-chain transactions |
Bybit 2025 |
Identified in subsequent fund movements reported by Bybit’s CEO |
| Railgun |
Privacy-focused DeFi protocol |
Uses cryptography to provide transaction privacy |
Bybit 2025 |
Named in Bybit’s public reporting on subsequent movements |
Sources: Bitquery’s investigation of the Bitget hack; The Block’s report on Bybit’s fund tracing;Elliptic’s investigation of the Bybit hack.
The table reflects the findings of the cited investigations rather than independent conclusions about criminal responsibility.
In particular, a protocol’s appearance in an on-chain transaction does not establish that its developers or operators knew the funds were stolen.
Case Study 1: THORChain and the 2025 Bybit Hack
On February 21, 2025, cryptocurrency exchange Bybit experienced a security breach involving approximately $1.5 billion in digital assets.
On February 26, the US Federal Bureau of Investigation attributed the theft to North Korean malicious cyber actors operating under the designation TraderTraitor.
According to the FBI, the attackers converted some of the stolen assets into Bitcoin and other cryptocurrencies, distributing them across thousands of blockchain addresses.
The agency subsequently called on cryptocurrency exchanges, blockchain infrastructure providers, and other virtual asset businesses to help identify and block transactions associated with the stolen funds.
Source: FBI — North Korea Responsible for $1.5 Billion Bybit Hack.
What Role Did THORChain Play?
THORChain is a decentralized liquidity protocol designed to support swaps between native cryptocurrency assets across different blockchains.
Unlike a conventional centralized exchange, its cross-chain functionality does not require users to deposit assets into a traditional custodial trading account.
This makes THORChain useful for legitimate cryptocurrency transactions involving different blockchain ecosystems.
However, the protocol also appeared prominently in investigations following the Bybit theft.
On February 27, 2025, The Block reported that blockchain investigators had identified substantial volumes of stolen ETH moving into Bitcoin through THORChain.
The report cited research from Arkham Intelligence and security expert Taylor Monahan, including an estimate that approximately 161,490 ETH had passed through THORChain-related transactions at that stage of the investigation.
These figures represented a dated snapshot of the investigation, not a final accounting of all stolen assets.
Source: The Block — Bybit Hackers Move Stolen ETH Into Bitcoin.
Does This Mean THORChain Was Hacked?
THORChain has experienced multiple hacks and security incidents over its history including the most recent $11M exploit in May 2026. However, the reported use of THORChain to exchange stolen assets is different from an exploit of THORChain itself.
In the Bybit incident, the initial theft occurred through a compromise affecting Bybit’s wallet transaction process. THORChain subsequently appeared in the movement where the stolen assets are involved.
The distinction is important.
A blockchain protocol can function according to its intended design while being used by parties conducting illicit transactions.
Determining whether a protocol has a security vulnerability requires separate technical evidence.
The incident also highlighted difficult questions surrounding decentralized governance, transaction screening, and the ability of permissionless infrastructure to restrict suspicious activity.
Case Study 2: Cross-Chain Protocols and the 2026 Bitget Hack
On September 24, 2026, cryptocurrency exchange Bitget experienced a security incident involving unauthorized transfers from exchange-controlled wallets.
In an official update published on September 25, Bitget confirmed that approximately $387.5 million in assets had been transferred to attacker-controlled addresses.
The exchange identified affected assets across several blockchain networks, including Ethereum-compatible networks, XRP Ledger, Zcash, and TRON.
Bitget also stated that it was working with independent cybersecurity specialists, including Mandiant and SlowMist, as part of its investigation.
Source: Bitget — Official Security Incident Update.
Why Is the Bitget Case Significant?
The Bitget investigation demonstrates that blockchain fund tracing is not limited to identifying a single destination wallet.
Investigators must often establish relationships between transactions involving different assets, networks, and services.
It also shows why timestamps matter when interpreting blockchain investigations.
A transaction analysis published immediately after an incident may differ substantially from an investigation updated several days later.
For example, Bitquery’s September 30 analysis incorporated additional Zcash-related transactions that were not included in its initial reporting.
Readers should therefore avoid treating early estimates or wallet balances as permanent findings.
Cross-Chain Bridges vs Crypto Mixers: What’s the Difference?
Cross-chain bridges and cryptocurrency mixers are sometimes discussed together in reports about stolen cryptocurrency.
However, they are designed to perform different functions: bridges move assets or value between supported networks, while mixers can pool or swap users’ cryptocurrencies to hide the transaction trail and make links between transactions harder to follow.
| Feature |
Cross-Chain Bridges |
Crypto Mixers |
| Primary purpose |
Transfer assets or value between supported networks |
Improve transaction privacy |
| Typical use case |
Move assets between blockchain ecosystems |
Reduce publicly observable links between transactions |
| Changes blockchain network |
Generally yes |
Not necessarily |
| Conceals transaction relationships |
Not inherently |
Privacy is a primary objective |
| Transaction visibility |
Often traceable through bridge records |
Depends on the privacy mechanism |
| Legitimate applications |
DeFi access, asset transfers, interoperability |
Financial privacy and confidentiality |
| Investigation challenges |
Linking transactions across networks |
Establishing relationships between deposits and withdrawals |
How Do Crypto Mixers Work?
A cryptocurrency mixer is a service or protocol designed to reduce the publicly observable relationship between incoming and outgoing transactions.
Different mixers use different technical approaches.
Some use pooled transactions, while others rely on cryptographic techniques that allow users to demonstrate certain transaction properties without publicly revealing all underlying details.
Tornado Cash, for example, uses privacy-preserving cryptographic mechanisms to reduce the direct visibility of deposit-withdrawal relationships.
These technologies have legitimate privacy applications, but they can also appear in investigations involving stolen assets.
Their use may raise additional regulatory and compliance considerations depending on the service, jurisdiction, participants, and applicable restrictions.
Are Cross-Chain Swaps Anonymous?
Not necessarily. Cross-chain protocols may publish transaction records that allow observers to associate incoming assets with outgoing assets.
For example, some swap records contain destination information that investigators can use to reconstruct transaction relationships.
The presence of multiple blockchain networks can increase analytical complexity without making the transactions inherently untraceable.
This distinction is essential when evaluating claims that stolen cryptocurrency has become impossible to track.
Why Do Stolen Funds Sometimes Move Into Bitcoin?
Bitcoin frequently appears in investigations involving stolen cryptocurrency because it is a widely traded digital asset supported by numerous exchanges and liquidity providers.
However, exchanging stolen assets for Bitcoin does not remove their transaction history.
Bitcoin transactions remain publicly recorded, and investigators can analyze wallet movements using blockchain data.
The February 2025 Bybit incident provides an example.
The FBI reported that the attackers converted some stolen assets into Bitcoin and distributed them across multiple addresses and blockchains.
Similarly, Bitquery’s investigation of the September 2026 Bitget incident identified multiple cross-chain transactions resulting in Bitcoin.
These examples demonstrate that asset conversion and transaction privacy are different concepts.
Changing one cryptocurrency into another may complicate an investigation, but it does not automatically eliminate the ability to trace the assets.
How Do Blockchain Investigators Trace Stolen Cryptocurrency?
Blockchain investigators combine publicly available transaction data with specialized analytics and other forms of evidence.
Their work may involve several complementary techniques.
Transaction Graph Analysis
Investigators examine the relationships between blockchain addresses and transactions.
This helps identify how assets move between wallets and whether different addresses appear connected through transaction activity.
Wallet Attribution
Blockchain analytics providers may associate addresses with known exchanges, services, or other entities.
However, wallet attribution is not always conclusive.
An address receiving cryptocurrency from an exchange does not automatically belong to the exchange, and the owner of a self-custody wallet may not be identifiable from blockchain records alone.
Cross-Chain Transaction Analysis
Investigators compare transactions across multiple blockchains.
Where supported by protocol records, they may identify relationships between assets entering a bridge or swap service and assets received on another network.
Exchange, Service, and Law Enforcement Agencies Cooperation
Centralized exchanges and other virtual asset service providers may possess information unavailable on public blockchains.
Where legally appropriate, cooperation between service providers, investigators, and authorities can help establish additional transaction context.
Asset Freezing and Recovery
Some cryptocurrency assets may be frozen under specific circumstances.
For example, certain centralized token issuers have administrative controls that can restrict transfers involving particular token addresses.
Other assets may lack equivalent freezing mechanisms.
The ability to freeze or recover cryptocurrency therefore depends on the asset, blockchain, custody arrangements, and applicable legal processes.
Blockchain tracing can identify movements of funds, but successful recovery is not guaranteed.
Does the Use of a Protocol in a Hack Mean the Protocol Is Unsafe?
There are several distinct types of risk that should not be confused.
Protocol security risk refers to vulnerabilities in smart contracts, cryptographic systems, or other technical components.
Operational risk involves failures in systems, processes, access controls, or infrastructure.
Illicit-use risk arises when a legitimate service is used in transactions associated with unlawful activity.
Regulatory risk concerns the legal obligations and restrictions that may apply to a protocol, its operators, or its users.
A protocol appearing in an investigation involving stolen cryptocurrency does not automatically establish that it has a technical vulnerability.
Likewise, a protocol having legitimate use cases does not eliminate the possibility of security or compliance risks.
When evaluating decentralized infrastructure, users should consider independent security assessments, technical design, governance arrangements, operational history, and applicable legal requirements.
What Can Cryptocurrency Users Learn From Exchange Hacks?
Major exchange security incidents highlight the importance of understanding both custody risk and the wider blockchain ecosystem.
Understand How Assets Are Held
Cryptocurrency exchanges may use combinations of hot wallets, warm wallets, and cold wallets to manage digital assets.
These arrangements involve different operational and security considerations.
Users should understand whether their assets are held through a custodial exchange or a self-custody wallet.
Strengthen Account Security
Security measures such as strong authentication, withdrawal protections, and phishing awareness can reduce exposure to certain account-level threats.
However, account security features cannot eliminate every risk associated with an exchange or its infrastructure.
Evaluate Blockchain Services Carefully to Avoid Crypto Fraud
Before interacting with a decentralized protocol, users should understand its purpose, supported networks, security assumptions, and potential smart contract risks, and the best way to reduce risk is to verify the platform, team, and investment opportunity before sending cryptocurrency.
A basic background check on the company or service should come before transferring funds.
A service being widely used does not guarantee that it is risk-free.
Follow Verified Security Updates
During a major security incident, transaction figures and preliminary explanations can change rapidly.
Official exchange announcements, law enforcement notices, and clearly attributed blockchain investigations provide a stronger foundation than unverified social media claims.
Even credible early investigations may contain incomplete information.
Conclusion
The movement of stolen cryptocurrency across blockchains demonstrates both the transparency and complexity of modern digital asset infrastructure.
Cross-chain protocols, decentralized exchanges, bridges, and privacy services support legitimate cryptocurrency activity, but some of these technologies have also appeared in investigations involving stolen assets.
The 2025 Bybit and 2026 Bitget incidents show how investigators must analyze transactions across different assets, wallets, and blockchain networks to understand the movement of funds.
These cases also reinforce an important distinction: the use of a decentralized protocol in an illicit transaction does not necessarily mean that the protocol was compromised or that its operators participated in wrongdoing.
For cryptocurrency users, understanding these technologies provides useful context for evaluating security risks, interpreting blockchain investigations, and making informed decisions about digital asset custody.
FAQ
Can stolen Bitcoin be traced?
Yes. Bitcoin transactions are publicly recorded and can be analyzed. Confirmed cryptocurrency transactions generally cannot be reverse, which is one reason stolen crypto is difficult to recover.
However, tracing transactions does not always establish who controls a wallet, and some transaction patterns or privacy techniques can complicate investigations.
Can hackers make stolen cryptocurrency completely untraceable?
There is no universal answer. Some funds can still be tracked, but quick response is essential and can sometimes stop further loss.
Some privacy technologies can conceal transaction details, while transparent blockchain records may allow investigators to reconstruct substantial portions of an asset’s movement.
The ability to trace funds depends on the networks, services, privacy mechanisms, and evidence involved. Criminals may use several methods to complicate tracing, but prompt reporting still helps investigators.
Does using a decentralized protocol mean a transaction is anonymous?
No. Many decentralized protocols operate on transparent blockchains and publish transaction information that can be analyzed.
Decentralization and anonymity are separate characteristics.
Can stolen cryptocurrency be recovered?
Recovery depends on a number of factors, including how quickly victims respond, and may be possible in some circumstances, including when assets are frozen, voluntarily returned, or recovered through legal and investigative processes.
As a first clear step, stop contact with the scammer and do not pay any additional money or fees.
If compromise is suspected, secure any remaining assets by moving them to a new wallet with a fresh seed phrase.
Be wary of crypto fraud recovery services promising guaranteed results for an upfront fee, as scammers often target theft victims with fake recovery offers.
However, recovery depends on the specific incident and cannot be guaranteed.
