Arbitrum darknet exposure bridges from Ethereum after an illicit cash-out, then continues through L2 DEX routes.
Attributed services versus noisy neighbors
The canonical bridge's withdrawal delay creates a visible pending window to Ethereum that investigators can watch.
Cash-out paths after a sale
High L2 throughput means busy routers are normal. Demand attributed illicit counterparties.
What the case note must capture
Use Arbitrum traces, not mainnet history under this label. This information is not legal or financial advice.