When Cryptocurrency Changes Form: What the Bitfinex Investigation Reveals About Chain Hopping

When cryptocurrency moves between different assets or blockchain networks, the investigative process can become more complicated. A transaction trail may include exchanges, intermediary wallets, conversion services and assets that operate on different technical systems.

The term chain hopping is commonly used to describe movement between different cryptocurrencies or blockchain environments. It can make tracing more complex, but it does not automatically make transactions impossible to investigate.

The Bitfinex hack provides a real-world example. According to the US Department of Justice, the laundering activity following the 2016 theft included conversions between cryptocurrencies, transfers through exchanges, mixing services and other techniques intended to obscure the movement of the stolen funds.

Connecting transactions across systems

Investigators need to establish how one stage of a transaction trail relates to another. Relevant information may include transaction identifiers, timestamps, amounts, exchange deposits and withdrawals, and records obtained through lawful investigative processes.

Amounts may differ between stages because of fees, market movements or the mechanics of a particular service. Investigators must understand those differences before claiming that a particular transfer represents the continuation of an earlier one.

Timing alone is not enough. Two transactions occurring close together do not necessarily establish that the assets in the second transaction came from the first.

Recognising the limits of attribution

A blockchain record may establish that assets were sent to an address, while additional evidence is required to determine who controlled the destination or whether a particular service held the assets for a customer.

Some services pool funds from many users. Others may provide internal transaction records that are not visible on the public ledger. A careful investigation distinguishes between what can be observed directly and what depends on additional information.

What a good tracing report should contain

A useful report should explain the transaction path, identify the evidence supporting each connection, document assumptions and state any unresolved questions. It should be possible for another qualified analyst to review the methodology and understand why the conclusions were reached.

The Bitfinex case shows that investigators may reconstruct complicated movements across different services and assets. The lesson is not that every trail can be solved, but that systematic analysis and corroboration are essential when attempting to understand the movement of digital assets.

Source: US Department of Justice — Bitfinex laundering investigation