- The paper systematically reviews methodologies for cross-chain transaction identification and matching.
- The analysis identifies four key identification approaches: official-record lookup, signature matching, address aggregation, and learned classification, each with trade-offs depending on available evidence.
- Matching methods range from deterministic identifier matching to model-assisted, achieving high performance depending on the type and extent of available evidence and verification capabilities.
This paper presents a systematization of knowledge (SoK) on cross-chain transaction identification and matching, addressing a gap left by prior SoKs that focus on bridge protocol design, attack surfaces, and architectural flaws rather than transaction-level evidence analysis (2608.17532). The authors organize the field along two core tasks—identifying which transactions are cross-chain deposits or withdrawals, and matching deposits to withdrawals across chains—and ground their taxonomy in a central observation: the applicability and reported performance of every method is bounded by the evidence the underlying system exposes.
Motivation and scope
The stakes are quantified directly: cumulative losses from bridge attacks reach approximately $2.8 billion (about 40% of value stolen in Web3), monthly cross-chain transfer volume exceeds $12 billion, and Elliptic estimates over $21.8 billion in illicit or high-risk funds have moved through DEXs, bridges, and swap services without KYC checks. The Lazarus Group's laundering of Bybit proceeds via rapid chain-hopping illustrates the operational relevance. The survey covers works from 2019 to 2026 analyzing deployed systems: contract bridges (canonical L1–L2 bridges and messaging protocols), instant cryptocurrency exchanges, and centralized cross-ledger platforms. Protocol design, contract-level vulnerability analysis, and single-chain-only tracing are excluded except where relevant.
A key structural observation is that cross-chain transfers are harder to analyze than single-chain ones because no single ledger records an entire transfer. Evidence is scattered across source chain, destination chain, and off-chain systems, with availability varying widely: some bridges write explicit pairing identifiers into events; others leave only ordinary transfers sharing time, amount, and addresses. The paper abstracts a contract-bridge transfer into three stages (source-chain action, off-chain attestation/relay, destination-chain settlement) and classifies systems by service form—smart-contract bridges, instant exchanges/cross-ledger services, and aggregators—noting that aggregators break the one-deposit-one-withdrawal assumption entirely.
Identification approaches
Deposit and withdrawal identification is organized into four approaches:
Official-record lookup uses platform ledgers or APIs. Its dependence is stark: among thirty bridges surveyed by Yan et al., only four provide a usable API (2608.17532).
Signature matching enumerates dedicated events and function selectors from audited contract source code. It requires open-source contracts, and a bridge upgrade renaming an event invalidates hand-written rules.
Address aggregation exploits the funnel-shaped topology of centralized services, where many one-off deposit addresses aggregate into hot wallets. CLTracer recovered 1.77 million deposits this way, but its own survey of nineteen platforms shows roughly half can be traced similarly while the rest route funds into exchange wallets or leave deposits unspent.
Learned classification treats identification as classification over execution structure and event-log text. XSema achieves 94.85% macro F1 on six unseen bridges when trained on four—a strong generalization result—but its training labels come from official bridge explorers, so the dependence on platform cooperation merely shifts from inference time to training time.
Matching mechanisms
Matching methods fall into three classes ordered by evidence strength.
Deterministic identifier matching relies on explicit association clues. Off-chain platform records give pairings directly but fail in three documented ways: correctness failures (9,956 transactions differed in amount between ledger and chain, and 308 were marked successful despite failing on chain); availability failures (works depending on Multichain's explorer became irreproducible after its 2023 collapse); and coverage failures (ShapeShift usage declined drastically after mandatory KYC). On-chain event identifiers—message IDs, srcTxHash, deposit IDs—are publicly re-verifiable and durable. Jigsaw pairs via such identifiers on ten of thirteen bridges and reaches a 99.8% overall matching rate on about eighty million transactions, the largest matching study surveyed. XChainDataGen extracts 11.29M cctx from five protocols across eleven chains using identifiers alone.
Field-constraint heuristics match on addresses, amounts, timestamps, tokens, and fees when no identifier exists. Their performance varies sharply with evidence quality: in the Ethereum–Polygon tracing, ERC721 withdrawals (dedicated event, unique token ID) reach 92.78% matching, while ERC20 withdrawals fall to 67.55% because the bridge emits only standard Transfer events indistinguishable from ordinary transfers. User-timed claim steps stretch the effective time window from ~24.2 minutes for deposits to ~6.4 days, leaving the time constraint nearly useless there. A recurring weakness is residual ambiguity: filtering often leaves multiple candidates, and each work disambiguates differently (earliest timestamp, tightened windows, scoring, or keeping only unique candidates).
Model-assisted matching targets per-bridge adaptation cost. ABCTRACER combines NER-derived explicit clues with Siamese-network implicit clues, reaching 91.75% bidirectional F1 on twelve bridges and 93.95% F1 on unseen bridges trained on only 25% of them. ConneX restricts its LLM to selecting a candidate five-tuple of fields, with deterministic rules completing verification—an F1 of 0.9746 versus 0.71 when the LLM picks paired transactions directly. LOCARD uses agents for query planning and evidence collection while deterministic rules make the pairing decision.
The paper distills three insights here. First, evidence differs not just in strength but in verifiability and durability; the most dependable pairing evidence is a publicly verifiable join key on chain. Second, in every surveyed work, LLMs and agents serve only to lower adaptation cost—the final decision remains deterministic rules over verifiable evidence. Third, the ceiling of matching performance is set by the evidence the system leaves behind, which explains why Jigsaw's 99.8% deterministic rate should not be read as ranking above ABCTRACER's 91.75% learned F1: they operate at different evidence levels.
Downstream applications
Matched pairs feed attack detection and fund tracing: Jigsaw's CrossAlert flags 94 abnormal matches out of ~80.05M transactions, including 47 unmatched ones involving over $605M in losses; ABCTRACER identifies 20 attack pairs and 10 laundering paths; ConneX traces Bybit-related stolen funds to Solana. Three issues remain unsettled. BridgeGuard finds 65.7% of attack transactions have no counterpart on the other chain and therefore does not require pairing, whereas BridgeShield builds detection graphs on paired transactions. A missing counterpart is inherently ambiguous—it may indicate a fake deposit attack or simply a data gap. And evaluation is incomparable across detectors due to differing label sources, sample units, and absent end-to-end latency reporting.
Dataset availability
The reproducibility audit is one of the paper's most consequential contributions. Of fifteen surveyed works, only seven provide obtainable data artifacts—fewer than half—and the failure modes are concrete:
| Failure mode |
Example |
| Promised only |
Jigsaw's 80M-transaction dataset has no findable link |
| Missing link |
ICE study claims open-source data but gives no URL |
| Expired anonymous repo |
ConneX's data lived only in a double-blind review repository |
XSema claims "the first cross-chain semantic dataset" yet provides no way to obtain it. Among obtainable datasets, label provenance matters: most depend ultimately on platform cooperation, whereas XChainDataGen builds ground truth by joining on-chain identifiers and thus survives platform disappearance. Coverage concentrates on EVM chains and 2021–2025; LOCARD alone targets native-asset chains (BTC, DOGE, LTC), and no usable public dataset exists for instant exchanges. The paper argues datasets remain reproducible only as long as all three dependencies survive—the archive, the platform records behind labels, and the chain data—and recommends archiving all three together.
Open challenges
Four challenges are distilled. First, interpreting missing counterparts under partial evidence: future matching should quantify data coverage and report the likelihood that a missing counterpart reflects a data gap rather than an attack, with verdicts conditioned on matching completeness (an unmatched withdrawal under a heuristic leaving a third unmatched signals nothing). Second, one-to-many and many-to-many matching: aggregators, liquidity pools, and multi-hop arbitrage routes (ten routes crossing two or three bridges found among 34.8M transactions) violate one-to-one assumptions, motivating set-to-set matching with confidence-scored candidates. Third, ground truth and benchmarks: a shared test set with labeled label provenance and held-out bridges is needed before reported rates become comparable; until then, releasing ground truth alongside code is the practical minimum. Fourth, verifiable use of models and agents: no surveyed system measures task quality, adaptation cost, and auditability together, so whether LLM components add enough value over deterministic scripts to justify their nondeterminism remains unestablished.
Conclusion
This SoK provides the first systematic treatment of how transaction-level evidence supports cross-chain identification and matching, establishing an evidence hierarchy that explains observed performance ceilings and exposing a reproducibility deficit in which fewer than half of claimed artifacts remain obtainable. Its central claim—that the bottleneck lies less in algorithms than in whether evidence exists, whether ground truth is credible, and whether judgments can be verified under incomplete evidence—is well supported by the surveyed results, though the taxonomy necessarily inherits the limitations of published evaluations whose denominators and correctness checks are defined inconsistently across papers.