Tracing stolen crypto across chains and bridges
· 4 min read · KadenaTrace
A thief who stays on one chain is easy to follow. Most do not. They move funds through bridges to other chains, swap them into other tokens, and spread them out, so that anyone following has to change explorers, address formats and tools at every hop. This guide explains how cross-chain tracing works, using the Binance hack of October 28, 2026, which KadenaTrace traces across eight networks and records on Kadena as six cases.
One hack, six cases
The trace starts from the address the funds were first sent to (0x5227…, on Ethereum and on Arbitrum), and from addresses the reports attribute to the attacker on Ethereum, Bitcoin and TRON. Each became its own case on Kadena, because each is a separate wallet with its own history:
| Case | Network | What it follows |
|---|---|---|
| KT-13 | Ethereum | the address the funds were first sent to: swaps through Uniswap and CoW Swap, and moves to addresses labeled as exchanges |
| KT-14 | Arbitrum | the same 0x5227… address as KT-13, on another chain |
| KT-16 | Ethereum | an address the reports attribute to the attacker |
| KT-17 | Bitcoin | the Bitcoin side, attributed by the reports |
| KT-18, KT-19 | TRON | two TRON addresses attributed by the reports, funds split into hundreds of wallets |
The same address on two chains is two wallets
Ethereum, Arbitrum, Base, BNB Chain and the other EVM chains share one address format. For an ordinary wallet, one key controls 0x5227… on Ethereum and 0x5227… on Arbitrum, but on chain they are separate accounts with separate balances and histories. Money does not move between them unless something carries it, and that something is a bridge.
KadenaTrace keeps every wallet as network plus address. That is why KT-13 and KT-14 are separate cases, and why the trace never merges the two just because the letters match. A link between chains is drawn only where a bridge transfer shows it.
How a bridge transfer is matched
A bridge takes funds on one chain and releases equivalent funds on another. On the source chain you see a deposit into the bridge's contract; on the destination chain, a payout from the bridge to some address, usually a little later and a little smaller after fees. The two are not linked by an obvious field; the trace matches them by the bridge's own records (a message or order id) where the bridge publishes one, and by amount and timing otherwise.
In the Binance trace, the bridges seen so far are MetaMask Bridge and LI.FI on Ethereum, and Stargate on Arbitrum. Where a bridge's landing is matched, the trace continues on the destination chain as if nothing happened. Where it is not, the incident page counts it as an open bridge transfer and the totals are marked "at least".
Where cross-chain trails break
- Unsupported bridges. A new or obscure bridge whose records the tracer cannot read leaves a gap: the deposit is visible, the landing is not matched.
- Chains the tracer does not follow. Funds bridged to a chain outside the 11 networks KadenaTrace reads are shown as "landed on [chain], not followed yet".
- Swap-and-bridge services that pool many users' funds work like a mixer for the hop they cover.
- Time. Some bridges settle in minutes, some in hours. A landing "not found yet" may simply be pending.
In every one of these cases the page says so. Read the trace coverage line on the incident page before you quote a total.
How to trace across chains yourself
- Start a trace on the chain where the funds left: Trace.
- Follow it to the bridge. The trace labels known bridge contracts.
- Where the landing is matched, keep reading on the destination chain; KadenaTrace does this automatically.
- Where it is not, look up the bridge's own explorer (most large bridges have one) with the deposit transaction hash.
- Report any exchange deposit on either side quickly. See exchange deposits and freezes.
What this guide does not claim
Addresses are called the attacker's only where the reports the incident page cites attribute them; the address the funds were first sent to is shown as a receiver. Cross-chain links are drawn only from bridge transfers the trace matched, never from look-alike addresses or timing alone. Figures are as recorded on October 31, 2026; the case pages have the current state.