Tracing And Analyzing Illicit Cryptocurrency Transactions

Abstract

As decentralized finance (DeFi) continues to scale, traditional forensic methodologies often fail due to their retrospective, "post-mortem" nature, analyzing illicit activities only after they are permanently recorded on the ledger. This project proposes coinEth, a real-time institutional blockchain surveillance and autonomous defense system designed for the Ethereum Sepolia network. The framework operates across a four-layer architecture: a Data Acquisition Layer that intercepts pending transactions via Alchemy WebSockets (WSS); a Persistence and Forensic Engine that utilizes SQLite and Python-based heuristics to detect suspicious behavioral patterns such as "structuring" and "high velocity"; a Governance Layer that executes an autonomous enforcement loop via a Solidity-based "Gatekeeper" smart contract; and a Visualization Layer built with Streamlit and PyVis. By assigning dynamic risk scores—categorized as Safe (Level 0), Warning (Level 1), and Frozen (Level 2)—the system can automatically broadcast on-chain transactions to freeze illicit accounts before fund exfiltration occurs. Furthermore, coinEth reconstructs a chronological "money trail" through sequential path mapping (T0 → T1 → T2...), ensuring a verifiable digital chain of custody for investigative reporting. This proactive approach shifts blockchain security from passive observation to active, real-time intervention, significantly enhancing the defense mechanisms available to institutional stakeholders.