A specialized subtechnique of Chain Hop in which criminals send tokens to a burn address on one blockchain (permanently removing them from circulation) and mint an equivalent amount on another chain. By using burn addresses that have no private keys, these tokens become irretrievable upon burning, thereby creating a gap in the transaction trail that severs direct links between the original and newly minted assets. This process obscures the ultimate origin of funds and complicates forensic analysis, particularly when combined with minimal-KYC cross-chain bridging solutions or decentralized exchanges. Criminals may also use wrapped tokens or stablecoins in conjunction with burn-and-mint to further impede chain analytics, making it more challenging to trace asset provenance.
Burn and Mint Transfers
Burn and Mint
Burn Address Usage in Chain Hopping
Tactics
Burn-and-mint transfers sever the traceable link between original and newly created tokens by permanently destroying assets on one chain and recreating them on another. This obfuscates the true origin of funds and complicates forensic analysis, aligning directly with the objective of layering, which is to obscure illicit proceeds through complex transactional steps.
Risks
Criminals leverage the inherent properties of stablecoins and wrapped tokens to further complicate tracing. These products facilitate cross-chain interoperability, allowing seamless burning and re-minting while maintaining peg values or backed assets. Their design features reduce volatility risk and can camouflage illicit transactions, making it harder for investigators to follow the funds' provenance.
Burn-and-mint transfers exploit cross-chain bridging channels that often lack centralized oversight or KYC requirements. By burning tokens on one chain and minting them on another, criminals sever the direct transactional links, thereby complicating AML detection and forensic analysis. These unregulated or minimally regulated channels are the primary vulnerability enabling anonymity and rapid layering across multiple blockchain networks.
Indicators
Noticeable changes in the customer's transaction behavior, such as an abrupt increase in the volume or frequency of transfers to burn addresses compared to historical activity.
Customer profile demonstrates no plausible business rationale or legitimate economic explanation for destroying assets on one chain and re-minting them elsewhere.
Discrepancies between the declared source of funds in official KYC records and on-chain records showing large or repeated transfers to burn addresses.
Frequent or repeated digital asset transfers from a customer’s wallet to addresses known to be permanent burn addresses, lacking any plausible commercial or operational rationale.
Rapid re-minting of an equivalent amount of assets on another blockchain shortly after burning tokens, commonly associated with cross-chain layering strategies.
Transactions involving burned assets that occur in consistent, round-number amounts which deviate from the customer's typical transaction patterns.
Repeated use of multiple burn addresses across different transactions or blockchains, particularly those linked to unverified or high-risk jurisdictions, indicating layering or obfuscation strategies.
Frequent bridging or swapping of newly minted tokens or stablecoins via minimal-KYC or decentralized platforms immediately following burn events, complicating provenance tracing.
Data Sources
Offers risk-based insights on countries, regions, and regulatory environments. In relation to Burn and Mint Transfers, this data:
- Identifies potential use of burn addresses or bridging services in high-risk or unverified jurisdictions
- Highlights cross-border layering strategies exploiting weaker regulatory controls
- Supports deeper geographic risk analysis of complex cross-chain token movements
Contains records of user accounts, transactions, and compliance details from VASPs. For Burn and Mint Transfers, such data:
- Reveals bridging or swapping of newly minted tokens shortly after burn events
- Indicates minimal-KYC or decentralized platforms enabling cross-chain re-minting
- Helps assess whether users are bypassing stricter compliance measures
By analyzing VASP data, investigators can trace layering or obfuscation attempts involving burn-and-mint schemes.
Contains verified customer identities, beneficial ownership data, and declared sources of funds or business rationale. For Burn and Mint Transfers, these records allow investigators to:
- Compare stated economic purposes with actual on-chain activity involving burn addresses.
- Identify discrepancies between customer-declared funds and large or repeated burn-and-mint transactions.
- Assess whether customers’ stated profiles align with abrupt changes in transactional behavior indicative of cross-chain layering.
Includes detailed on-chain transaction information such as addresses, timestamps, amounts, token transfers, and burn events across various blockchain networks. For burn and mint transfers, these records enable investigators to:
- Identify tokens sent to burn addresses and correlate them with newly minted tokens on other chains.
- Detect cross-chain layering strategies by tracking associated burn and re-mint transactions.
- Pinpoint suspicious or repetitive use of burn addresses and link them to broader illicit activity patterns.
Mitigations
Conduct deeper checks on customers who engage in token destruction and reissuance, focusing on proving legitimate sources of funds and verifying the need for cross-chain migration. Review the timing and amounts of burned versus newly minted tokens, and scrutinize customer links to any unregulated bridging solutions. By applying Enhanced Due Diligence (EDD), institutions maintain heightened visibility on high-risk customers leveraging burn-and-mint tactics.
Implement specialized on-chain analytics to identify addresses definitively used for burn events (i.e., lacking private keys) and correlate burned token amounts with newly minted tokens on other chains. Monitor short intervals between burns and re-mints to detect cross-chain layering attempts. By pinpointing these burn-to-mint sequences, institutions can better address the technique’s core vulnerability of obscuring asset provenance through chain transitions.
Utilize open-source intelligence channels to identify newly reported or suspicious burn addresses, minimal-KYC bridging platforms, and stablecoin-wrapping services involved in burn-and-mint activities. Cross-reference public data, social media forums, or blacklists to uncover potential illicit activity tied to these channels. This enables targeted monitoring or account restrictions for customers interacting with known high-risk addresses.
Coordinate with other institutions, blockchain analytics providers, and relevant authorities to exchange details on known or emerging burn addresses, suspicious bridging solutions, and usage patterns. By pooling intelligence on entities frequently exploiting burn-and-mint methods, participants can more easily identify cross-chain layering attempts and mitigate the technique’s obfuscation effects.
Restrict or freeze customers' ability to transfer or burn tokens when burn-and-mint patterns lack a credible business rationale. Impose additional compliance checkpoints before allowing bridging or re-minting if the user has recently engaged in large or repeated burns, especially through minimal-KYC cross-chain platforms. These measures help prevent criminals from exploiting burn-and-mint layering techniques to obscure the origin of funds.
Instruments
- Criminals burn stablecoins on one chain, removing them from circulation, and re-mint identical stablecoins on another chain.
- The stable value reduces volatility risk while layering funds across blockchains, making suspicious fluctuations less noticeable.
- Immediate swapping of newly minted stablecoins via minimal-KYC or decentralized exchanges further severs transaction history, masking the funds’ true origin.
- Criminals send tokens (e.g., on Ethereum) to a burn address with no private keys, permanently removing them from circulation.
- They then mint an equivalent amount of tokens on another public blockchain, breaking any direct on-chain linkage to the original funds.
- By leveraging minimal-KYC cross-chain bridging services or decentralized platforms, the newly minted tokens appear disconnected from the initial source, complicating investigators’ efforts to trace asset provenance.
- Criminals exploit wrapped tokens, which are pegged to underlying assets on separate blockchains, to facilitate burn-and-mint obfuscation.
- After burning the original tokens on one chain, they mint wrapped equivalents on another chain, effectively creating a fresh transaction record.
- This approach fragments the audit trail across multiple networks, impeding chain analytics and complicating investigators' attempts to link the newly minted tokens back to the original source.
Service & Products
- Criminals use DeFi protocols (including decentralized exchanges) to quickly swap newly minted tokens for other assets, often bypassing traditional KYC requirements.
- Leveraging wrapped tokens or stablecoins within DeFi deepens obfuscation, making transactional origins harder to track.
- The open, permissionless nature of many DeFi platforms allows funds to circulate rapidly, further complicating chain analytics.
- Near-instant token swaps facilitate rapid layering by converting newly minted assets into different cryptocurrencies, severing direct transactional links.
- Limited or no KYC requirements allow criminals to quickly cycle through multiple chains, impeding traceability.
- Swaps often occur in large or systematic amounts immediately after burn events, thwarting investigators attempting to follow the origin of assets.
- Facilitates transitioning assets across different blockchains, enabling criminals to sever the direct link between the original chain and newly re-minted tokens.
- Minimal-KYC or unregulated bridging channels obscure provenance, breaking transaction continuity.
- This method adds complexity to forensic tracing by scattering transactional evidence across multiple networks.
Actors
Professional money launderers employ burn-and-mint transfers to:
- Destroy tokens on one chain by sending them to non-recoverable burn addresses, eliminating direct links to illicit funds.
- Re-mint equivalent tokens on a different blockchain, breaking the audit trail and complicating chain analytics.
- Leverage minimal-KYC cross-chain bridging solutions or decentralized exchanges to further conceal the origin of re-minted tokens, impeding investigators’ ability to track the source of funds.
Virtual asset service providers are exploited by criminals using burn-and-mint transfers when:
- Offering cross-chain bridging or token swap services with limited or no KYC measures.
- Facilitating rapid exchanges of newly minted tokens, obscuring transaction histories and making chain analytics more challenging.
These services unwittingly enable criminals to layer funds across multiple networks, creating anonymity gaps for financial institutions.
References
Carlisle, D. (2024). Preventing financial crime in cryptoassets: Identifying evolving criminal behavior. Elliptic.https://www.elliptic.co/hubfs/Elliptic%20Typologies%20Report%202024.pdf
Costa, A. (2023). Preventing financial crime in cryptoassets: Investigating illicit funds flows in a cross-chain world. Elliptic.https://www.elliptic.co/hubfs/Elliptic_LEA_Typologies_2023_Report.pdf
Zubic, E. (2024). Chain Hopping in Crypto: How to Track Cross-Blockchain Fund Movement. OSINT Ambition. https://publication.osintambition.org/chain-hopping-in-crypto-how-to-track-cross-blockchain-fund-movement-138da36dd6e9