Bridge Wizardby The Block Audit

Guide

One search to rule them all, One search to find them.
A push token to learn their name, and with two bracelets bind them.

Bridge Wizard finds which bridge moved a transfer between blockchains and shows both sides of it: where the funds came from and where they went. This guide explains how that works, what each bridge can be searched by, and what to do with the answer.

Finding the transaction to search

The transaction hash is the best thing to search. It names one specific transfer, and every covered bridge can find its swap from at least one side. An address search depends on the bridge having recorded that exact address, and some bridges can reach an address's history only within a window of days.

Either side works. Search the deposit (the transaction where funds left the wallet into the bridge) or the payout (the transaction where funds arrived from the bridge). Bridge Wizard identifies the swap from either one and verifies the other.

Which transaction to search A wallet sends a deposit transaction into a bridge; the bridge sends a payout transaction to a recipient. Either transaction's hash can be searched. Wallet the address Bridge contract or vault Recipient on the other chain deposit payout Search either transaction's hash

How to find it.

Where to look, by chain. On Ethereum-style explorers, the Transactions and Token Transfers tabs, where bridge contracts are often labelled. On Tronscan, the Transfers tab (TRC-20 for USDT). On mempool.space, the transaction's outputs, including any OP_RETURN memo. On Solana explorers, the list of signatures for the address.

How a cross-chain transfer moves

Blockchains cannot see each other. A bridge moves value between two of them by doing something on each side: the sender makes a deposit on the source chain (to the bridge's contract, vault or a one-time deposit address), and the bridge, or a solver working for it, makes a payout to the recipient on the destination chain. If the payout cannot be made, a refund goes back to the sender. In between there may be a message, a signature, a swap or a step on the bridge's own chain.

How a cross-chain transfer moves The sender deposits on the source chain. The bridge carries a message or has a solver pay out. The recipient is paid on the destination chain. Each side is a separate transaction on a separate chain; the bridge's record links them. Source chain Sender Deposit transaction to the bridge's contract The bridge Message, solver or relayer keeps the record Destination chain Payout transaction Recipient or a refund to the sender Bridge Wizard links the two sides through the bridge's own record
Each side is a separate transaction on a separate chain. Only the bridge's record connects them.

A messaging bridge (LayerZero, Wormhole, Axelar) carries a message that an app acts on: Stargate, USDT0, Portal or Squid moves the money. An intent bridge (Relay, Across, deBridge, Mayan Swift, NEAR Intents) has a solver pay the recipient from its own funds and be repaid from the deposit. A liquidity network (THORChain, Maya, Chainflip) swaps native assets through its own pools, often from a one-time deposit address. An atomic swap (Garden) locks both sides to the same secret. An exchange service (HiFiSwap, Bridgers) takes the deposit and pays out from an order record its operator keeps.

How Bridge Wizard connects the two sides

Paste a transaction from either side, a wallet address, or a bridge's own reference, and Bridge Wizard asks every covered bridge at once whether it recognizes it.

  1. Forward, from a deposit. If you have the transaction that sent the funds in, the tool finds the swap it funded and shows where the money went: the payout transaction, the recipient and the amount. If the payout has not happened yet, the card says Payout pending and how long ago the deposit was made.
  2. Backward, from a payout. If you have the transaction that received the funds, the tool finds the swap that paid it and shows where the money came from: the deposit transaction, the sender and the amount. Most bridges can be searched by the payout directly. Harbor cannot, so for Harbor the tool finds when the payout confirmed and searches Harbor's public list of swaps for the days before it (48 hours at first; you can widen that to 14 days or all of Harbor's history, which starts on 2025-11-06).
  3. Refunds and steps in between. A refund, or a transaction the bridge made along the way (a NEAR transaction, a THORChain internal leg), leads to the swap it belongs to, and the card says which it is.
  4. By a bridge's own reference. An order id, request id, swap id, deposit channel, VAA id or message id opens the swap it names. A bare number is tried at every bridge that numbers its swaps; when more than one has it, you choose which one you mean.
  5. One card per swap. Each card shows the source on the left and the destination on the right, marks the transaction you searched, and says in one sentence what happened. When an aggregator (LI.FI) and the bridge it routed through (for example Relay) both report the same deposit and payout, they are one swap and one card, "LI.FI via Relay".
  6. Checking it on chain. Where the chains allow, the tool reads the transactions themselves: the note (OP_RETURN) in a Bitcoin deposit against the memo the bridge recorded; the note in a THORChain or Maya payout naming the deposit; the one-time deposit address a sender paid; the contract a deposit reached; and what the source transaction sent and whom the payout transaction paid. Each check is shown on the side it verifies.

Searching by address. Paste a wallet address to list every bridge swap it sent or received. Each bridge is searched as its own API allows, and each says what that covers (the sender only, the sender and the recipient, and so on). A date range is optional; it is offered when a bridge can reach an address's history only within a window of days, and it narrows every bridge to that period.

Sent using. Most swaps are built by an app (a wallet, an exchange widget, an aggregator) that records a short code in the swap to collect its fee. The card names the app behind that code from a reference table with a source for every entry, showing the app the user touched rather than the routing layer behind it. The code identifies the interface, not the person, and a careful user can set or leave it out.

Notes on each kind of bridge

Messaging bridges (LayerZero, Wormhole). These carry a message from one chain to another, and an app built on them moves the money: Stargate, USDT0 and other token apps on LayerZero; Portal, Mayan, NTT and the CCTP integration on Wormhole. The card names the app ("LayerZero via Stargate") and reads the amounts and recipients from the transactions on each side. Stargate's bus mode sends many users' transfers in one delivery: the card lists every recipient and highlights the one you searched, and never presents a single passenger as the answer. An unredeemed Wormhole transfer (a signed message nobody has redeemed on the destination chain yet) is flagged, with the recipient who can still claim it.

Chainflip deposit channels. Most Chainflip swaps start with a one-time deposit address a broker opens for one swap, which the sender pays from any wallet. Chainflip records the deposit transaction, not who sent it, so for Bitcoin, Ethereum and Arbitrum deposits the tool reads the deposit transaction itself and shows the addresses that funded it as "Funded by (from chain data)". Chainflip also pays out in batches, so one payout transaction can belong to several swaps; each is shown.

HTLC atomic swaps (Garden). Garden locks both sides in hash time-locked contracts under the same secret hash: revealing the secret to claim the payout also lets the solver claim the sender's lock, so either both sides complete or both are refunded. The tool checks that both sides carry the same secret hash on their chains and that the revealed secret hashes to it.

Intent bridges (Across, deBridge, Mayan Swift, Relay). The sender deposits and a solver pays the recipient from its own funds, then is repaid from the deposit. Either transaction finds the swap: the deposit directly, and the payout through the event it emits, which names the order. A deposit nobody fills in time is refunded, and the card says so.

Axelar and Squid. Axelar carries a message; Squid uses it to swap across chains. An express execution pays the recipient first from a relayer's funds and is repaid later by the ordinary execution, which leads to the same card. A message that failed to execute, or was sent with too little gas, says so.

Exchange services (HiFiSwap, Bridgers). The sender pays the service on one chain and the service pays the recipient on another from an order record its operator keeps. HiFiSwap cards say that the operator holds the order records, and the data request targets name its published law enforcement contact.

Symbiosis, TeleSwap, Meson, Omni Bridge, Allbridge, Hyperliquid, Circle CCTP, Hyperlane. Symbiosis routes through its own chain, and any of its three transactions finds the swap. TeleSwap moves Bitcoin to EVM chains through a light client; the check reads the Bitcoin deposit's OP_RETURN naming the recipient. Meson swaps stablecoins through liquidity providers. Omni Bridge is NEAR's bridge; NEAR Intents sends its withdrawals through it, and both records of one transfer are one card. Allbridge hands its transfers to a messenger (mostly LayerZero). USDC sent to Hyperliquid's bridge on Arbitrum is credited to an exchange-like account. Circle CCTP burns USDC on one chain and mints it on the other once Circle attests the burn. Hyperlane finds a message by either of its transactions; a warp-route transfer shows the user and amount carried in the message and the token from the router on chain, and any other message is shown as a message.

Why ordinary block explorers miss bridged transfers

A block explorer shows one chain. On the source chain it shows the deposit going to a bridge contract, a vault or a fresh deposit address, and there the trail stops. On the destination chain the payout comes from the bridge, a solver or a pool that pays thousands of people, so nothing on that chain points back to the sender.

Using data request targets

Under "Sent using" on a card, Data request targets lists who may hold records about the swap, most actionable first: the stablecoin issuer when USDT or USDC was received, the app that built the transaction, any routing aggregator, and the bridge's operator (or a plain statement that a decentralized protocol has no operator holding user records).

  1. Act on a freeze first. When USDT or USDC was received and may still be in the recipient's wallet, the issuer can sometimes freeze it. Time matters more than anything else on the list.
  2. Cite the identifiers. Each target lists the swap's identifiers (transaction hashes, addresses, order or request ids) with a time window around the swap. "Copy request details" copies them as text for a request draft.
  3. Ask for the records it holds. Each record type is marked "documented", with the page where the entity says it collects it, or "typical for this type of service" when no official page confirms it.
  4. Send it where the entity says. A law enforcement channel is listed only where the entity itself publishes one, with its source and the date it was checked. Otherwise the card says none was found and links to The Block Record.

Push notification tokens

A wallet app that sends notifications holds a push token for the phone it runs on. The token is issued by Apple (APNs) or Google (FCM), and the platform that issued it can associate it with an account and a device. When a wallet app's records are available, asking for the push token tied to the wallet, then asking Apple or Google about that token, can lead from a self-custody wallet to an account. The data request targets mark which wallet apps document collecting push tokens.

These are investigative leads, not legal advice. Whether an entity holds these records, and the process required to obtain them, varies by entity and jurisdiction. No contact is ever guessed, and nothing is fetched to build the list.

Coverage

What each bridge can be searched by: its deposit (source) transaction hash, its payout (destination) transaction hash, a wallet address, and its own reference for a swap, with the known gaps.

Searchable by

No match means none of the covered bridges recognized the search. It does not mean the transaction was not bridged: it may have gone through a bridge this tool does not cover yet. A bridge that could not be reached, was busy, or does not take that kind of search is marked "not checked" and is not counted as a no match.

Who it is for

The report

The Bridge Wizard Report is a standalone Excel workbook: a Summary sheet (the answer, as on the card, then the query, payout time, days searched and method), a Swap sheet (every field of the swap, by bridge, and the on-chain checks), an Evidence sheet (the raw record from each bridge, the URL it came from, its SHA-256, and the raw verification responses) and, when a card lists them, the data request targets. An address search's report lists every swap found. The SHA-256 of each response lets anyone reproduce the retrieval.

Privacy

Nothing you enter is stored. The hash, address or reference you enter is relayed through this site's own functions to each bridge's public API or explorer service, to public block explorers and RPC nodes to read transactions, and for Tron checks to TronGrid; Harbor is queried by date only, never by your hash. None of them sees your IP.

Usage statistics. Bridge Wizard counts searches and which bridges and wallet apps appear in results, to improve coverage; it never records what you searched. When a search finishes, the page sends only the kind of search, whether it found a swap, the names of the bridges, routing layers and apps in the result, and the conditions shown (pending, refunded and the like), added to that day's totals. No hash, address, amount, time of day or IP address is kept. Your theme and whether you hid the highlights are remembered in your own browser only. We count searches by country, time zone, hour of day and referring site. We do not store IP addresses or anything you search.

Frequently asked questions

What is Bridge Wizard?

A free tool from The Block Audit that identifies which bridge moved a transfer between blockchains and shows both sides of it: the deposit on the source chain and the payout on the destination chain, with the sender, the recipient and the amounts.

What can I paste into the search box?

A transaction hash from either side of a bridge (the deposit, the payout, a refund or a step in between), a wallet address, or a bridge's own reference for a swap, such as an order id, a request id, a deposit channel or a VAA id.

Which bridges does it cover?

23 bridges and aggregators, including THORChain, Maya, Chainflip, NEAR Intents, Relay, LI.FI, LayerZero and Stargate, Wormhole, Across, Circle CCTP, deBridge, Mayan, Axelar and Squid, Garden, Symbiosis and Omni Bridge. The Coverage section of this guide lists what each can be searched by.

Can it identify a transfer from its payout?

Yes. Paste the transaction that received the funds and the tool finds the swap that paid it, then shows the deposit, the sender and the amount on the source chain. A few bridges can be searched only by the deposit, and the result says so.

Why did my search find nothing?

None of the covered bridges recognized it. The transfer may have gone through a bridge this tool does not cover, or the transaction may not be a bridge transfer at all. A bridge that could not be reached or does not take that kind of search is marked not checked rather than counted as no match.

How does it verify what a bridge reports?

Where the chains allow, it reads the transactions themselves: that the deposit paid the bridge what the record says, that the payout paid the recipient, and that notes, memos or secret hashes on each side match. Each check is shown on the side it verifies.

What does Sent using mean?

Most swaps are built by an app, such as a wallet or an exchange widget, that records a short code in the swap to collect its fee. Sent using names the app behind that code from a sourced reference table. It identifies the interface, not the person.

What are data request targets?

A list, on each result, of who may hold records about the swap: the stablecoin issuer when USDT or USDC was received, the app that built it, any routing aggregator and the bridge's operator, with the records each may hold, the identifiers to cite and any law enforcement channel it publishes.

Is what I search stored or shared?

No. Searches are relayed through this site's own functions, so the bridges' services do not see your IP, and nothing you enter is kept. Only anonymous daily counts are recorded: the kind of search and which bridges and apps appeared in results.

What is in the downloadable report?

An Excel workbook with the answer as shown on the card, every field of the swap by bridge, the on-chain checks, and each raw response with the URL it came from and its SHA-256, so the retrieval can be reproduced.