ZachXBT: Increased bridge volumes could disguise hacker activity

On-chain researcher ZachXBT believes bridging volumes may be a sign of hacking activity and attempts to obscure the origin of funds. Bridging has been growing for legitimate reasons, while also serving to mix or swap funds more easily. 

On-chain researcher ZachXBT noted that bridge volumes may not be organic, instead being caused by hackers aiming to launder funds. 

ZachXBT commented on a recent X post by @arjunnchand, which suggested LiFi protocol sees record volumes. 

pic.twitter.com/UNLp55AREp

— Tay 💖 (@tayvano_) June 3, 2025

Bridges most often serve to bring funds back to the Ethereum main chain, which then grants access to TornadoCash or other DEX services used for mixing. Cross-chain bridges also serve in instances of multi-chain attacks. 

The LiFi bridging service faces a challenge similar to other Web3 protocols, where its permissionless nature means few tools to stop bad actors, and an unwillingness to screen for them on principle. The case is similar to the peak volumes of THORChain following the Bybit hack, where the protocol was among the few to deny cooperation, monitoring, and freezing of funds. 

LiFi received criticism not just for its accidental usage by hackers, but for celebrating the increased volumes as a sign of growth. The LiFi founder and team stated they have been trying to decrease hacker volumes, though the bridge service has always seen some share of unwanted transactions.

ZachXBT points to DPRK activity on bridges

ZachXBT believes sudden peak volumes can signal the involvement of DPRK hackers trying to launder funds. The Bybit hack has still been a source of traffic for bridges, which caused increased chain-hopping to evade address screening. 

In the case of the LiFi bridge, ZachXBT estimates 15-25% of the activity may be due to the involvement of DPRK hackers. LiFi also works as a bridge aggregator, aiming to offer seamless cross-chain swaps. 

Previously, bridge activity was sometimes due to incentives or airdrop farming. Some chains have generally higher bridging activity, due to their active DeFi sector. Bridging is often a way to cash out of a protocol or a DeFi exchange. 

Bridges are among the most vulnerable smart contracts, often leading to sizeable attacks and the draining of funds. 

Bridge volumes have increased in the past month

The investigations of ZachXBT coincide with a general growth in bridge volumes for the past month. Bridges remain key for the ecosystem, most often for moving funds between Ethereum and L2 chains. 

Over $880M goes through various bridges daily, with most of the volume concentrated on top apps. Arbitrum saw the biggest bridging volumes in the past month, for a total of $2.77B. 

However, small bridges are also raising red flags for sudden spikes in volumes. Some of the bridges handle very low volumes, hence any deposit is a significant gain. For others, like the Hyperliquid bridge, activity is linked to increased demand for the underlying app. 

LayerZero, the leading bridge as of May 2025, also increased its net volumes in the past month, with significant daily spikes. Bridge activity also grows based on DEX demand and attempts to introduce cross-chain tokens.

KEY Difference Wire: the secret tool crypto projects use to get guaranteed media coverage