A Full-Node Blockchain Forensic Framework for Cross-Layer Virtual Asset Tracking

Abstract

Cybercrimes that exploit virtual assets—including laundering, concealment, and illicit financing through the dark web—are increasing rapidly, while existing tracking tools remain limited when offenders leverage multi-layer blockchain architectures and off-chain mechanisms to obscure fund flows. This paper proposes a practical full-node-based blockchain forensic framework for the automated detection and tracking of illicit virtual asset transactions across Layer-1 and Layer-2 environments. The framework operates a full-node network to construct a continuously updated database of all on-chain transactions, from which exchange-controlled internal addresses are identified using six formalized heuristics (H1–H6) expressed as a weighted-sum scoring model. A unified multi-layer transaction graph incorporates Layer-2 events—payment channel closures, rollup batch submissions, and bridge deposits and withdrawals—as contextual edge attributes correlated with Layer-1 settlement. Protocol-specific cross-layer correlation procedures, covering Arbitrum retryable tickets, Optimism cross-domain messages, zkSync Era batch commitments, and third-party bridge relays, were validated on live main-net transactions. Applying the framework to 7511 suspect wallet addresses, 821 (10.93%) were attributed to four Korean exchanges, and real laundering cases involving mixing and swapping—together with integrated real-time alerting and transaction-freeze request functions—demonstrate its direct applicability to law enforcement investigations. In addition, attribution reliability is quantified through the 98.80% labeling consistency observed across repeated independent collections of the same addresses, the standard forensic metrics are formally defined together with publicly released evaluation tooling, and the end-to-end detection latency is bounded analytically by the confirmation properties of the underlying protocols, substantiating the real-time capability of the framework.