{"id":6489,"date":"2025-08-01T12:00:37","date_gmt":"2025-08-01T12:00:37","guid":{"rendered":"https:\/\/bitunikey.com\/news\/hackers-ditch-mixers-for-bridges-in-lightning-fast-crypto-laundering-play-analysts-say\/"},"modified":"2025-08-01T12:00:42","modified_gmt":"2025-08-01T12:00:42","slug":"hackers-ditch-mixers-for-bridges-in-lightning-fast-crypto-laundering-play-analysts-say","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/hackers-ditch-mixers-for-bridges-in-lightning-fast-crypto-laundering-play-analysts-say\/","title":{"rendered":"Hackers ditch mixers for bridges in lightning-fast crypto laundering play, analysts say"},"content":{"rendered":"
\n

Cross-chain bridges have overtaken traditional mixers as the primary tool for laundering stolen crypto in early 2025, moving over $1.5 billion in hacked funds. Their speed, liquidity, and lighter regulatory scrutiny have made them far more attractive than mixers like Tornado Cash for obscuring asset origins.<\/p>\n

\n
\n Summary<\/span>\n <\/div>\n
\n
    \n
  • Crypto hacks in the first half of 2025 hit unprecedented levels, with over $3 billion stolen across 119 incidents, already 50% higher than all of 2024.<\/li>\n
  • Hackers are moving funds faster than ever, often laundering assets through cross-chain bridges rather than mixers, with some thefts fully obscured in minutes before any public disclosure.<\/li>\n
  • Centralized exchanges remain the primary cash-out points, while recovery efforts are limited, leaving most stolen funds either laundered rapidly or lying in wait for future movement.<\/li>\n<\/ul><\/div>\n<\/div>\n

    <\/p>\n

    The first half of 2025 marked one of the most destructive periods in the history of cryptocurrency hacks. According to a recent report by Global Ledger shared with crypto.news, more than $3 billion was stolen in 119 separate incidents, a figure that already surpasses total losses for all of 2024 by more than 50%.<\/p>\n

    Yet the sheer volume of attacks isn\u2019t the only alarm bell. The speed at which hackers move stolen funds \u2014 often before the theft is publicly known \u2014 has fundamentally changed the landscape of crypto crime, the analysts say.<\/p>\n

    <\/source><\/p>\n<\/picture>
    Hackers laundered 4.4x more via bridges than mixers in H1\u201925 | Source: Global Ledger<\/figcaption><\/figure>\n

    \u201cAttackers are moving faster, often laundering funds before the incident is even publicly known,\u201d the report states. In one case, the fastest movement of hacked funds took just four seconds, effectively giving attackers a head start measured in blinks of an eye. This rapidity severely limits the ability of current alerting systems and regulators to intervene before the money disappears.<\/p>\n

    By breaking down timelines, the analysts identified key patterns in how stolen assets are handled: how quickly they move, how long they remain idle, and which parts of the crypto ecosystem are most exploited.<\/p>\n

    \n

    \u201cKnowing these timing patterns can help detect suspicious activity sooner and reduce the window attackers have to launder funds. It is not just about reacting, it is about anticipating the next move.\u201d<\/p>\n

    Global Ledger<\/p>\n<\/blockquote>\n

    Bridges outpace mixers as laundering tools<\/h2>\n

    Perhaps the most significant finding concerns the methods hackers use to obscure the origin of stolen crypto. Cross-chain protocols \u2014 also known as cross-chain bridges \u2014 have apparently become the preferred method for laundering stolen crypto.<\/p>\n

    In the first half of 2025, over $1.5 billion, or 50.1% of all hacked assets, were routed through bridges. This dwarfs the $339 million \u2014 around 11% \u2014 sent to crypto mixers, which nonetheless remain in use in about half of hack cases.<\/p>\n

    <\/p>\n

    As Global Ledger notes, the functionality of cross-chain protocols is \u201cheavily leveraged by illicit actors, making them a key tool for obfuscating stolen funds origin.\u201d The report suggests that bridges are overtaking mixers as the preferred laundering tool \u201clikely due to their speed, liquidity, and lower regulatory scrutiny.\u201d<\/p>\n

    Mixers like Tornado Cash, which scramble funds by mixing them with others to break traceability, were once the standard for laundering crypto stolen in hacks. Bridges, which allow assets to be transferred quickly between different blockchain networks, now seem to provide more rapid movement and access to multiple liquidity pools, making it easier for hackers to move large sums swiftly and complicate tracing efforts by law enforcement.<\/p>\n

    Crypto exchanges remain the main cash-out points<\/h2>\n

    Another area of insight concerns where stolen funds ultimately land. Approximately 15% of hacked assets \u2014 $453 million \u2014 flowed into centralized exchanges, which are \u201chighly likely to be used for further cash-out,\u201d the analysts say. In contrast, decentralized finance platforms received only about a third of that amount, roughly $170 million or 5.6%.<\/p>\n

    Despite the rapid growth of DeFi usage and total value locked, the report underscores that centralized platforms remain the primary off-ramp for laundering stolen funds, suggesting that, for all their promise, DeFi protocols have yet to supplant traditional exchanges as the go-to destinations for hackers seeking to convert crypto to fiat or less traceable assets.<\/p>\n

    The report also paints a sobering picture regarding recovery efforts. Of the total stolen amount, nearly 13% \u2014 $379 million \u2014 was frozen or burnt, likely due to coordinated enforcement actions or security measures. Meanwhile, only a small portion, 4.6% \u2014 around $140 million \u2014 was voluntarily returned.<\/p>\n

    As Global Ledger says, enforcement efforts are making some impact, \u201cbut voluntary returns remain rare,\u201d emphasizing that \u201cmost recovery still depends on rapid intervention, not goodwill.\u201d<\/p>\n

    Only a matter of time<\/h2>\n

    A critical takeaway is the alarming speed with which attackers act. Funds from nearly one in four hacks were fully laundered before any public disclosure occurred, closing the window for law enforcement to track or freeze assets. The fastest complete laundering process \u2014 from theft to last deposit \u2014 was a mere two minutes and 57 seconds, barely enough time to blink.<\/p>\n

    <\/source>
    \n\"Hackers\n<\/picture>
    In 68.1% of hacks, funds moved before disclosure | Source: Global Ledger<\/figcaption><\/figure>\n

    \u201cSpeed has become the new dangerous weapon,\u201d the report warns, noting that the quickest movement of stolen funds was \u201cover 75 times faster than the alerting system.\u201d Once funds begin moving, the trail can go cold in hours or even minutes. Attackers clearly exploit this narrow response window: in over 30% of cases, illicit actors completed laundering within a day of the first wallet movement.<\/p>\n

    At the time of the report\u2019s research, $1.6 billion \u2014 or 53.6% of total losses \u2014 remained unspent, meaning these funds either did not move or their movement stopped. The report suggests that some of this amount is \u201clikely still in the process of being laundered, as attackers may be waiting for the heat to die down.\u201d<\/p>\n

    <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

    Cross-chain bridges have overtaken traditional mixers as the primary tool for laundering stolen crypto in early 2025, moving over $1.5 billion in hacked funds. Their speed, liquidity, and lighter regulatory…<\/p>\n","protected":false},"author":1,"featured_media":4578,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6489","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/6489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=6489"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/6489\/revisions"}],"predecessor-version":[{"id":6490,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/6489\/revisions\/6490"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/4578"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=6489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=6489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=6489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}