[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84448-en":3,"doc-seo-84448-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},84448,1099513958762,"Logic","https://ap-avatar.wpscdn.com/avatar/1000023916a998db790?x-image-process=image/resize,m_fixed,w_180,h_180&k=1782109480056885918",8,"Research & Report","RISKTAGGER Evidence-Guided LLM Agent for Post-Incident Forensic Analysis of Money Laundering in Web3","Cryptocurrency money-laundering forensic analysis after Web3 incidents is hindered by fragmented evidence, rapidly expanding transaction paths, and cross-chain discontinuity. Prior Web3 AML approaches often depend on manual clues and heuristic or graph tracing, producing suspicious-address lists without path-level proof and verifiable explanations. RISKTAGGER integrates an LLM as an evidence-constrained decision component in a controlled tracing loop, extracting clues from public incident materials, expanding a risk-labeled fund-flow graph with on-chain evidence, and generating evidence-organized reports for analysts.","RISKTAGGER: Evidence-Guided LLM Agent for Post-Incident Forensic Analysis of Money Laundering in Web3  \nDan Lin, Member, IEEE, Yanli Ding, Weipeng Zou, Jiajing Wu, Senior Member, IEEE, Zhiyin Wu,  \nJiachi Chen, Xiapu Luo, Zibin Zheng, Fellow, IEEE  \narXiv :2510 . 17848v2 [ cs .CR] 11 Jul 2026  \nAbstract—Cryptocurrency money-laundering forensic analysis after Web3 incidents faces challenges such as fragmented evidence, expanding transaction paths, and cross-chain discontinuity. Existing Web3 anti-money-laundering (AML) methods largely rely on manual clues and heuristic or graph-search-based tracing, with outputs typically limited to lists of suspicious addresses and lacking path-level evidence and verifiable explanations. Directly applying general-purpose large language models to raw transaction flows also struggles to ensure evidence constraints and result verifiability. To address these limitations, this paper presents RISKTAGGER, an LLM-guided agent for forensic tracing of Web3 cryptocurrency money laundering. RISKTAGGER embeds the LLM as an evidence-constrained decision component within a controlled tracing loop. It extracts case clues from public incident materials, recursively expands a risk-labeled fund-flow graph over on-chain evidence, and generates evidence-organized reports for analyst review. We evaluate the system on five realworld security incidents spanning multiple years and covering heterogeneous attack patterns and laundering path structures. We further conduct cross-case generalization analysis, baseline comparison, component ablation, and LLM backend analysis. In the main Bybit case, the system achieves a 97.33% address recall and a 98.69% expert-reviewed sampled address precision. Across the other four incidents, it achieves 95.24–100.00% address recall and 91.27–100.00% expert-reviewed address precision. The cross-case results further show that the complexity of Web3 money laundering arises from heterogeneous mechanisms, including short-cycle fund fragmentation, long-range laundering paths, interwoven DeFi services, and deterministic denomination splitting. RISKTAGGER can recover case-related fund paths, identify high-priority risk accounts, and organize public evidence into verifiable forensic reports.  \nIndex Terms—Web3 security, anti-money laundering, cryptocurrency tracing, forensic analysis, large language models  \nI. INTRODUCTION  \nTHE rapid development of Web3 has promoted decen  \ntralized finance and cross-chain asset flows [1], [2], but  \nManuscript received July xx, 2026; revised xxxx; accepted xxxx. This work is supported in part by the National Natural Science Foundation of China under Grant 62502548, Grant 62372485, and Grant 62332004; in part by the Open Research Fund of The State Key Laboratory of Blockchain and Data Security, Zhejiang University; in part by the Hong Kong RGC Project under Grant PolyU15231223; and in part by Hong Kong RGC Grant for Themebased Research Scheme Project under Grant T41-517/25-N. (Corresponding authors: Jiajing Wu and Zhiying Wu)  \nDan Lin, Yanli Ding, Weipeng Zou, Jiajing Wu, Zhiying Wu, and Zibin Zheng are with the School of Software Engineering, Sun Yat-sen University, Zhuhai 519082, China, and the Guangdong Engineering Technology Research Center of Blockchain, Zhuhai, China ([Email: wujiajing@mail.sysu.edu.cn](Email: wujiajing@mail.sysu.edu.cn))  \nJiachi Chen is with The State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China, and also with the Hangzhou HighTech Zone (Binjiang) Institute of Blockchain and Data Security, Hangzhou, China.  \nXiapu Luo is with the Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China.  \n~~ ~~ Risky Address List   \nFig. 1. Motivation. Manual analysis and existing tracing algorithms often stop at risky-address lists, while auditors require evidence-grounded rationales and transaction-path context.  \nhas also made large-scale cryptocurrency theft and subsequent money laund","cbCair86OCXdNwJI","https://ap.wps.com/l/cbCair86OCXdNwJI","pdf",1394823,1,13,"English","en",105,"# Introduction\n## Motivation and problem definition\n## Related work and limitations\n## Role of large language models","[{\"question\":\"What main challenges does post-incident money laundering forensics in Web3 face?\",\"answer\":\"It struggles with fragmented evidence, expanding transaction paths, and cross-chain discontinuity, which makes rapid reconstruction and audit-ready explanations difficult.\"},{\"question\":\"How does RISKTAGGER improve over existing Web3 AML tracing methods?\",\"answer\":\"It embeds an LLM into an evidence-constrained decision component within a controlled tracing loop, enabling risk-labeled graph expansion and evidence-organized, verifiable reports rather than only address lists.\"},{\"question\":\"How was RISKTAGGER evaluated and what results were reported?\",\"answer\":\"The system was evaluated on five real-world security incidents with cross-case generalization, baselines, ablations, and LLM backend analysis. In the main Bybit case it reported 97.33% address recall and 98.69% expert-reviewed sampled address precision, with strong precision/recall ranges across the other four incidents.\"}]",1784195684,33,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"risktagger-evidence-guided-llm-agent-for-post-incident-forensic-analysis-of-money-laundering-in-web3","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/risktagger-evidence-guided-llm-agent-for-post-incident-forensic-analysis-of-money-laundering-in-web3/84448/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What main challenges does post-incident money laundering forensics in Web3 face?","Question",{"text":75,"@type":76},"It struggles with fragmented evidence, expanding transaction paths, and cross-chain discontinuity, which makes rapid reconstruction and audit-ready explanations difficult.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does RISKTAGGER improve over existing Web3 AML tracing methods?",{"text":80,"@type":76},"It embeds an LLM into an evidence-constrained decision component within a controlled tracing loop, enabling risk-labeled graph expansion and evidence-organized, verifiable reports rather than only address lists.",{"name":82,"@type":73,"acceptedAnswer":83},"How was RISKTAGGER evaluated and what results were reported?",{"text":84,"@type":76},"The system was evaluated on five real-world security incidents with cross-case generalization, baselines, ablations, and LLM backend analysis. In the main Bybit case it reported 97.33% address recall and 98.69% expert-reviewed sampled address precision, with strong precision/recall ranges across the other four incidents.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]