Cross-chain criminal and high-risk crypto activity has surged past an estimated $21.8 billion as of May 2025, according to blockchain analytics firm Elliptic – up from Elliptic’s previous estimates of $7 billion in 2023 and $4 billion in 2022.
According to Elliptic’s 2025 Cross-Chain Crime Report, approximately 33% of complex cross-chain investigations involve more than three blockchains, while 27% span five or more, and 20% span more than ten.
One of the biggest groups responsible for this illicit activity is North Korea, which is linked to about 12% of the $21.8 billion total. Elliptic says North Korean hackers are using more advanced cross-chain methods to hide stolen crypto.
“Sanctions evasion, especially North Korea-related crypto activity, continues to be one of the biggest risks when it comes to monitoring cross-chain activity,” the report explains.
Cumulative Growth of Illicit Crosschain Activity
These findings highlight that as blockchains and digital assets grow, criminals are increasingly turning to decentralized exchanges (DEXs), cross-chain bridges, and swap services to carry out hacks, scams, and launder illicit funds.
“Criminal actors are exploiting the growing complexity of the crypto ecosystem – but they can be stopped,” said Dr. Arda Akartuna, Lead Crypto Threat Researcher at Elliptic, according to a press release viewed by The Defiant. Dr. Akartuna said that thanks to advanced cross-chain analytics, experts and authorities are now provided with “crucial visibility into illicit flows.”
Beyond North Korea, Elliptic found approximately $300 million in illicit cryptocurrency linked to Iranian services under U.S. sanctions. Criminals in Russia, Iran, and North Korea are using anonymous swap services more often to turn crypto into privacy coins and hide where the money comes from.
No type of crypto crime is exempt from cross-chain activity, Elliptic’s report also notes. In particular, the firm highlights a rise in cross-chain risks linked to scams. There’s also been a rise in criminals using cross-chain services to hide money from online gambling, especially from gambling sites that operate illegally.
“Authorities’ focus on gambling has increased in recent months and years, particularly after the betting craze during the 2024 US elections,” the report reads, noting that around 25% of all illicit and high-risk activity observed flowing through coin swap services relates to online gambling.
Elliptic also cited the $1.46 billion North Korean hack of Bybit in February 2025, which it said reflected the “significant use of dark web services” in the same month for the laundering of the stolen funds.
Earlier this year, Elliptic helped track Bybit’s stolen funds following the hack. It also partnered with the U.S. Secret Service to take down Russian exchange Garantex, according to Elliptic’s blog.
