用智能体框架实现链上追踪,自动拆解洗钱团伙。
LOCARD: An Agentic Framework for Blockchain Forensics

- 将链上调查建模为分步决策过程,引入三核认知架构。
- 在15.1万条真实跨链记录上验证,精准追踪到Bybit黑客资金流向。
- 适合研究区块链安全与智能体应用的开发者和研究人员。
链上取证天然具有动态迭代特性,但现有方法多依赖静态推理流程。本文提出代理式链上取证(ABF)新范式,将调查过程视为序列化决策。为此构建了首个代理框架LOCARD,采用三核认知架构分离策略规划、执行与验证。不同于通用大模型代理,其通过结构化信念状态机制,在明确状态约束下保障取证严谨性。为验证该范式,将LOCARD应用于复杂的跨链交易追踪任务,构建包含超过15.1万条真实记录的Thor25基准数据集,并在拆解Sybil集群的组转账追踪任务中测试。基于Bybit黑客事件的真实洗钱子流验证,LOCARD实现高保真追踪,证明将链上取证建模为自主代理任务不仅可行且高效。代码与数据已公开。
原文摘要 · Abstract (English)
Blockchain forensics inherently involves dynamic and iterative investigations, while many existing approaches primarily model it through static inference pipelines. We propose a paradigm shift towards Agentic Blockchain Forensics (ABF), modeling forensic investigation as a sequential decision-making process. To instantiate this paradigm, we introduce LOCARD, the first agentic framework for blockchain forensics. LOCARD operationalizes this perspective through a Tri-Core Cognitive Architecture that decouples strategic planning, operational execution, and evaluative validation. Unlike generic LLM-based agents, it incorporates a Structured Belief State mechanism to enforce forensic rigor and guide exploration under explicit state constraints. To demonstrate the efficacy of the ABF paradigm, we apply LOCARD to the inherently complex domain of cross-chain transaction tracing. We introduce Thor25, a benchmark dataset comprising over 151k real-world cross-chain forensic records, and evaluate LOCARD on the Group-Transfer Tracing task for dismantling Sybil clusters. Validated against representative laundering sub-flows from the Bybit hack, LOCARD achieves high-fidelity tracing results, providing empirical evidence that modeling blockchain forensics as an autonomous agentic task is both viable and effective. These results establish a concrete foundation for future agentic approaches to large-scale blockchain forensic analysis. Code and dataset are publicly available at https://github.com/xhyumiracle/locard and https://github.com/xhyumiracle/thorchain-crosschain-data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。