DETECTING ILLICIT CROSS-CHAIN FUND MOVEMENT: BEHAVIORAL MACHINE LEARNING MODELS FOR BRIDGE-BASED LAUNDERING PATTERNS

Abstract

Illicit actors are turning to cross-chain bridges to move stolen crypto assets, using long transfer chains, frequent address changes, and irregular timing to mask where the funds came from. Once these behaviors show up, rule-based tracing techniques weaken, which leaves exchanges, compliance teams, and forensic analysts with far less visibility. This work introduces a machine learning approach that focuses on behavioral, temporal, and structural signals instead of fixed tracing rules to spot illicit movement across bridges. To support this, a synthetic dataset of multi-hop transfer paths is built to capture common laundering habits, including chain hopping, sequences of fresh addresses, token shifts, and uneven delays between transfers. Using this dataset, the study tests several models: an XGBoost baseline, an LSTM that treats transfers as sequences, a graph-enhanced XGBoost model, and a fused classifier that blends LSTM embeddings with structural features derived from graph representations. Model performance is evaluated using AUPRC, ROC AUC, and Precision at K to match how analysts typically review alerts. The fused model reaches perfect classification on the test set and surpasses all baselines, especially when ranking the most suspicious cases. SHAP-based interpretation highlights the impact of timing cues and address-level behaviors within the learned features. Robustness tests with distribution-shifted versions of the synthetic dataset show that performance remains steady when path length grows, addresses are reused, or token behavior shifts. These outcomes suggest that behavioral modeling with machine learning offers a strong route for detecting illicit cross-chain fund movement and provides a practical starting point for explainable monitoring tools that address bridge-related financial crime.