Layering through bridges and mixers
Moving funds through enough hops, chains and services that their origin stops being traceable. Distance is the point, which is also why distance alone proves very little.
Layering is moving funds through a series of steps whose purpose is to break the link between where money came from and where it ends up. Onchain that usually means hops between unhosted wallets, a crossing between chains, and often a service that pools funds from many people.
It is the middle stage of the classical three: placement, layering, integration. The first and last usually happen off the chain, which is why the layer you can see is rarely the whole of it.
Why it is treated as a concern
Layering is the stage where tracing is supposed to fail. A regime that can follow funds to their origin does not need the other two stages to be visible, so deliberate obfuscation is treated as material in its own right.
What it looks like
Signature patterns
- Hops with no economic purpose
Funds arriving and leaving within minutes, at close to the full amount, through a wallet that does nothing else.
- A chain crossing in the path
A bridge converts the asset and moves it to a different ledger. Tracing has to be resumed on the far side, and not every vendor does so.
- A pooling service
A mixer, a privacy protocol, or any service where many people’s funds are held together. After it, no particular coin can be followed.
- Splitting then recombining
One amount becomes eight, moves separately, and arrives as one again.
- Fresh wallets at every step
Addresses with no history before this transfer and none after it.
- Customer walletKnown
- UnhostedMinutes later, same amount
- BridgeAsset converted, ledger changes
- Pooling serviceFunds held with everyone else's
- DestinationNo particular coin can be followed here
Everything above the pooling service is a path. Everything below it is an apportionment rule somebody chose. A bridge is ordinary; a service whose purpose is to break traceability is not, and your programme should say which it treats that way.
Above the pooling service is a path. Below it is an apportionment rule somebody chose.
Where to look
| Look at | For |
|---|---|
| Time between hops | Minutes with no change in amount is the strongest single signal. |
| The wallets in the path | First-seen date and whether they did anything before or since. |
| The amount across the path | A near-constant amount, less fees, says one movement rather than several transactions. |
| Which side of a bridge the trace stopped | A vendor that does not resume on the far side reports a shorter path, not a shorter one in fact. |
| What sits at the far end | A licensed business ends the trace usefully. Another unhosted wallet does not. |
Distance is weak evidence on its own
Value mixes as it moves, and everybody’s funds pass through large services. A customer four hops from something concerning has almost certainly never touched it, and a figure reported at that distance is mostly the vendor’s apportionment rule. What carries weight is the character of the path, not its length.
What else produces this shape
Common false positives
- Treasury rebalancing
A business moving holdings between chains and custodians produces rapid multi-hop movement at near-constant amounts.
- Normal bridge use
Anyone paying on a chain they do not hold funds on has to cross one.
- Wallet migration
A customer moving to new software sends everything out in several transfers to fresh addresses, which looks exactly like fanning out.
- Aggregators and routers
A single trade can be routed through several contracts and look like a chain of hops when it was one instruction.
Related
What a typology is
A typology is a named pattern of financial crime, written down precisely enough that two people looking at the same case reach the same view about whether it fits.
Direct and indirect exposure
Exposure measures how much of the value reaching an address can be traced back to a category of concern, and how far away that category sits. The further away, the more of the figure is methodology rather than observation.
What an address cannot tell you
The chain records what moved, between which addresses, and when. Who held the keys, why they moved funds and whether they chose to all come from somewhere else.
Last checked against the product on .