This study examines the theoretical, structural, and empirical applications of Artificial Intelligence (AI) and Machine Learning (ML) architectures within the domain of regulatory compliance (RegTech) and supervisory technology (SupTech) for cross-border digital transactions. The exponential expansion of cross-border financial flows, real-time payment systems, and decentralized financial instruments has amplified regulatory fragmentation, multi-jurisdictional compliance friction, and sophisticated financial crime typologies. Utilizing institutional economics, information asymmetry theory, and computational compliance modeling, this paper analyzes how advanced algorithmic architecturesâspecifically Graph Neural Networks (GNNs), Natural Language Processing (NLP), and Federated Learningâoptimize anti-money laundering (AML), counter-terrorist financing (CFT), and real-time sanctions screening. The findings demonstrate that shifting from legacy rule-based heuristics to adaptive, privacy-preserving AI frameworks significantly compresses false-positive rates, bridges cross-jurisdictional regulatory disparities, and establishes a dynamic, mathematically rigorous paradigm for global financial integrity.
Abstract The boundary between traditional organized crime and cybercrime is eroding. Long-established criminal groups increasingly rely on encrypted communications, darknet markets, and cryptocurrency-based money laundering, while profit-driven cybercriminal groups adopt the durable structures, division of labor, and governance mechanisms long associated with organized crime. This article examines this convergence, understood as the organizational, operational, financial, and technological integration of traditional criminal groups and cybercriminal networks. The study combines a qualitative analysis of documents published between 2020 and 2026, including law enforcement reports, court records, and assessments by international organizations, with a case study of the Hive ransomware group and its disruption in 2023, complemented by supporting cases such as Conti, Hydra Market, EncroChat, and the online fraud compounds of Southeast Asia. Three vectors of convergence are identified: ransomware-as-a-service models and inter-group alliances; darknet marketplaces and the wider crime-as-a-service economy; and direct alliances between hackers and conventional criminal groups, including trafficking-based forced criminality. The article develops an integrative framework that links each vector to the organizational features it produces, to established criminological theories, and to corresponding enforcement levers. It concludes that convergence is a profit- and opportunity-driven adaptation to a weakly guarded digital environment and that effective responses require synchronized pressure on offenders, finances, infrastructure, and criminal service providers.
In cryptocurrency markets, credibility may be created before it can be verified. Promotional signals from influencers, online communities, exchanges, and project actors can create an impression of legitimacy before consumers are able to independently assess the quality, risks, or underlying value of the asset. This systematic review examines how promotional activity contributes to this condition and how the literature connects it with ethical concerns, consumer consequences, and governance. Following PRISMA 2020, 54 empirical studies published between 2019 and 2025 were identified through Scopus and analyzed using thematic synthesis. The findings indicate that promotion is distributed across social media, influencers, communities, exchanges, and project actors, making the boundary between marketing, personal opinion, and financial advice difficult to maintain. Ethical problems arise not only from fraud, but also from selective information, hidden incentives, artificial attention, and market signals that give uncertain assets an appearance of legitimacy. Consumer vulnerability is similarly situational. Knowledge and experience may offer some protection, but trust, technological complexity, social influence, and speculative expectations continue to shape judgement. Regulatory and educational responses remain fragmented because responsibility is dispersed across actors and jurisdictions. The review connects these relationships through an ethical marketing cycle that conceptually organizes how ethical concerns may develop across communication, market activity, consumer interpretation, and governance. This perspective extends ethical marketing beyond the accuracy of individual claims and locates responsibility within the structures through which cryptocurrency credibility is produced. The review is limited by its reliance on Scopus and the absence of a formal risk-of-bias assessment of the included studies.
Cybercrimes that exploit virtual assetsâincluding laundering, concealment, and illicit financing through the dark webâare increasing rapidly, while existing tracking tools remain limited when offenders leverage multi-layer blockchain architectures and off-chain mechanisms to obscure fund flows. This paper proposes a practical full-node-based blockchain forensic framework for the automated detection and tracking of illicit virtual asset transactions across Layer-1 and Layer-2 environments. The framework operates a full-node network to construct a continuously updated database of all on-chain transactions, from which exchange-controlled internal addresses are identified using six formalized heuristics (H1âH6) expressed as a weighted-sum scoring model. A unified multi-layer transaction graph incorporates Layer-2 eventsâpayment channel closures, rollup batch submissions, and bridge deposits and withdrawalsâas contextual edge attributes correlated with Layer-1 settlement. Protocol-specific cross-layer correlation procedures, covering Arbitrum retryable tickets, Optimism cross-domain messages, zkSync Era batch commitments, and third-party bridge relays, were validated on live main-net transactions. Applying the framework to 7511 suspect wallet addresses, 821 (10.93%) were attributed to four Korean exchanges, and real laundering cases involving mixing and swappingâtogether with integrated real-time alerting and transaction-freeze request functionsâdemonstrate its direct applicability to law enforcement investigations. In addition, attribution reliability is quantified through the 98.80% labeling consistency observed across repeated independent collections of the same addresses, the standard forensic metrics are formally defined together with publicly released evaluation tooling, and the end-to-end detection latency is bounded analytically by the confirmation properties of the underlying protocols, substantiating the real-time capability of the framework.
Type of the article: Research ArticleAbstractThe blockchain financial system allows users to send money fast without any border restrictions. However, the same structure of the blockchain may be used as a means of laundering money. This paper assesses the relationship between the complexity of transaction networks and the likelihood of their illicit nature within the public Elliptic Bitcoin benchmark and examines whether anomaly detection using machine learning helps to interpret risks from an AML/CFT perspective. This empirical analysis assumes that Elliptic provides an anonymized transaction network in which nodes correspond to Bitcoin transactions, edges reflect directed transactions, and anonymized features facilitate licit/illicit classification of transactions. Furthermore, the dataset is not considered evidence of sender wallet addresses, receiver wallet addresses, transaction amount, timestamp, ownership of exchanges, user geography, and national AML/CFT effectiveness. Based on the labelled analytical dataset presented in the uploaded workbook (46,564 observations, including 42,019 licit transactions and 4,545 illicit transactions), a logit model found a significant positive correlation between illicit transactions and degree centrality (beta = 1.870, p < 0.001), clustering coefficient (beta = 0.940, p < 0.001), and flow entropy (beta = 0.680, p < 0.001). Isolation Forest and Autoencoder reached AUCs of 0.866 and 0.841, respectively. In turn, the coefficient measuring a countryâs regulatory capacity and its interaction term are not included in the estimation because there is no country-window marginal effect. Therefore, this paper does not test for the impact of regulatory capacity of the USA, Singapore, and UAE on transaction classification.
Automated anti-money laundering (AML) on public blockchains is usually framed as a detection problem. Because the ledger is public and permanent, automated detection is feasible, but that record shows only that value moved, without showing who moved it or why. We review automated blockchain anti-money laundering as a system in which machine models and human analysts share each decision, following it through four stages: detection, attribution, adjudication, and reporting, and asking at each stage what automation does well, what it must leave to human judgment, and what goes wrong when that judgment is misplaced. The evidence shows a consistent asymmetry. Machine learning is strong at pattern-finding over the permanent public record, where models rank suspicion and clustering heuristics scale, but it weakens sharply as the task turns from finding a pattern to assigning meaning, identity, intent, or accountability. Drawing first on emerging AML-specific studies and then, where direct evidence remains insufficient, on human-factors research from adjacent high-stakes domains, we find an uneven evidence base. Automation is best supported for large-scale detection, alert prioritization, and parts of blockchain attribution, while the evidence becomes more limited as decisions require contextual interpretation, evidential judgment, accountability, and reporting. AML-specific studies identify explainability, flexibility, tool integration, supervisory justification, and human review as important operational requirements, but they do not yet establish how frequently analysts over-rely on, reject, or selectively follow automated recommendations. Evidence from aviation, healthcare, and public administration is therefore used to identify plausible failure mechanisms rather than to claim AML-specific effects. The result is an evidence-weighted allocation matrix that records, for each stage, the strength of the case for automation, the function retained by the analyst, the dominant failure mode, and the empirical question that remains unresolved. Support is strongest for detection, direct but context-dependent for attribution, and more provisional for adjudication and reporting.
Cybercrime investigation in India has entered a new legal phase following the commencement of the Bharatiya Nyaya Sanhita, 2023 (BNS), the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), and the Bharatiya Sakshya Adhiniyam, 2023 (BSA). These enactments operate alongside the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 (DPDP Act), sectoral regulation and specialised cybercrime institutions. This article argues that the principal weakness of the present framework is not a lack of offences, but fragmentation across legal classification, investigative procedure, digital-evidence rules, forensic practice, privacy governance and institutional coordination. Using doctrinal legal research supplemented by official policy and institutional material, the article develops an investigation-chain framework linking complaint triage, offence classification, preservation, lawful acquisition, forensic examination, attribution, financial tracing, cross-border evidence, prosecution and adjudication. It evaluates the continuing interaction between general criminal liability under the BNS and technology-specific provisions of the Information Technology Act, while examining the evidentiary significance of electronic records under the BSA. Particular attention is given to cloud evidence, cryptocurrency, ransomware, artificial intelligence and deepfakes. The article contends that technological traceability must not be equated with human attribution and that evidentiary reliability depends on the entire acquisition-to-trial chain. It proposes harmonised investigative protocols, accredited forensic capacity, specialist prosecution and judicial training, auditable access to personal data, improved cross-border preservation mechanisms, and a human-verification requirement for significant AI-assisted investigative outputs. The analysis contributes an India-specific but internationally relevant model for assessing whether contemporary cybercrime law can produce reliable, rights-compliant and trial-ready investigations.
Cryptocurrency began as a marginal experiment among cypherpunk technologists and has since become an asset class worth trillions of dollars globally, and its rise has been matched by a parallel rise in criminal activity that feeds off the pseudonymity, decentralisation and borderless movement these assets allow. India counts among the countries with the largest populations of crypto holders anywhere, yet Parliament has still not enacted any statute dedicated to virtual digital assets; oversight instead comes piecemeal, through tax provisions, anti-money-laundering notifications and rulings handed down case by case. This article sets out the scale of crypto-related crime worldwide, reviews the current statistics, and examines the jurisdictional and enforcement difficulties that follow from them, with particular attention to how those difficulties play out inside India. India's liability framework is then measured against a handful of foreign models, the Indian judiciary's engagement with the resulting legal gaps is assessed against international standards and model policy approaches, and the article closes by setting out a proposed regulatory framework.
Through this independent concept, the study introduces a fresh new perspective to the world of modern forensic accounting via a theory called âThe Decentralized Fraud Matrixâ (DFM). This conceptual research was developed specifically as an analytical tool to dissect the modus operandi of financial crimes in the digital-cyber eraâincluding Web3 environments, blockchain architecture, DeFi protocols, and autonomous DAO systems. The focus of the DFM theory completely breaks away from the basic assumptions of the conventional fraud triangle, which has long been overly preoccupied with measuring human emotions. Mechanically, the originality of this theory rests on the testing of three interlocking cyber indicators in the field. These three indicators include the level of opacity in an actorâs digital identity concealment; technological engineering designed to break the audit trail of fund flows; and the exploitation of loopholes in physical national sovereignty boundaries, as well as cyber âjurisdictional evasionâ tactics aimed at neutralizing the enforcement power of on-ground regulations, thereby rendering perpetrators immune to formal legal prosecution
Abstract - The rise of digital technology has led to an increase in cybercrime. This has made the management of digital forensic evidence more complicated. Traditional evidence management systems utilize manual methods and centralized databases. Methods like these are vulnerable to data tampering, unauthorized access, and human error. These issues threaten the integrity of the evidence and the chain of custody during the investigation process. In this paper, we introduce a system that utilizes blockchain technology, smart contracts, and a decentralized system for the tracking of forensic evidence. Security and transparency will be guaranteed. In our system, evidence records are stored as ERC-721 Non-Fungible Tokens. A private Ethereum blockchain was developed using Ganache and combined with wallet-based authentication and Role-Based Access Control to ensure that only authorized personnel have the ability to view and manage evidence. Smart contracts facilitate the registration, verification, transfer, and auditing of evidence, thus, considerably reducing the manual work and greatly increasing the trustworthiness of the system. We proposed a hybrid system of storage whereby evidence and its forensic files are stored off chain, and the evidence metadata and its forensic files are stored on chain. This paper presents the design and architecture of the system,implementation and evaluation are in progress.Our system will be a trusted, efficient, and effective system of evidence management.
The rapid digitalization of financial services has transformed the global financial ecosystem, enabling faster transactions, enhanced customer experiences, and greater financial inclusion. However, this digital transformation has simultaneously increased the complexity, scale, and sophistication of financial fraud. Traditional rule-based fraud detection systems often struggle to identify evolving fraud patterns, resulting in delayed responses, increased false positives, and substantial financial losses. Artificial Intelligence (AI)-powered real-time fraud monitoring systems have emerged as a transformative solution capable of detecting suspicious activities instantly through advanced data analytics, machine learning, deep learning, natural language processing, and behavioral intelligence. These systems continuously analyze vast volumes of transactional and non-transactional data, enabling financial institutions to identify anomalies, predict fraudulent behavior, and automate risk management processes with unprecedented accuracy and speed. This literature review examines the evolution, applications, technological foundations, benefits, challenges, and future directions of AI-powered real-time fraud monitoring systems in modern financial services. The review highlights how AI enhances fraud detection capabilities across banking, payment systems, insurance, digital wallets, cryptocurrencies, and investment platforms while discussing critical concerns related to privacy, algorithmic bias, explainability, cybersecurity, and regulatory compliance. The findings demonstrate that AI-driven fraud monitoring represents a fundamental component of modern financial security infrastructure and will continue to shape the future of fraud prevention in increasingly digital financial environments.
The widespread problem of cyberbullying in todayâs digital environment is made worse by the quick spread of IoT devices and the difficulties in organizing and protecting digital evidence. Traditional forensic methods are often inadequate due to their inability to provide a tamper-proof chain-of-custody and their limited scalability under high data loads. To overcome these constraints, our work makes use of innovative technologies such as a permissioned blockchain (Hyperledger Fabric), powerful encryption methods (AES-256 and RSA), and decentralized off-chain storage (IPFS). We propose an integrated, blockchain-driven forensic evidence collection framework that ensures secure, real-time evidence acquisition from diverse IoT devices, automated validation via smart contracts, and efficient, Role-Based Access Control for evidence retrieval. A hybrid consensus mechanism, combining elements of PBFT and Proof-of-Stake, enhances the systemâs security and scalability while reducing processing latency and energy consumption. Experimental results demonstrate that our approach achieves high throughput and low latency, making it a strong and reliable solution for forensic investigations in cyberbullying cases. Within our experimental scope, the framework strengthens the integrity and authenticity of digital evidence and addresses key regulatory considerations, though real-world validation remains future work.
With the rapid advancement of decentralized finance (DeFi), security incidents related to cryptocurrency have become increasingly prevalent. After such incidents, attackers typically attempt to rapidly move stolen assets, concealing the origin of illicit funds and ultimately converting them into fiat currency. However, existing anti-money laundering (AML) methods struggle to cope with the semantic complexity of DeFi transactions. They either rely heavily on low-level token transfers, or perform protocol-agnostic money flow analysis, failing to capture the high-level intent of transactions. In this paper, we propose AMLGuard, a semantic-aware AML framework for account-based blockchains. AMLGuard tracks illicit fund flows from known malicious addresses by performing semantic analysis on complex DeFi transactions, enabling accurate and continuous laundering tracking. Given a complex transaction, AMLGuard combines static rule-based analysis with retrieval-augmented large language model (LLM) reasoning to infer implicit DeFi semantics, transforming raw transaction data into high-level semantic representations. Furthermore, for cross-chain transactions where laundering intent is not explicitly exposed, AMLGuard parses transaction parameters and performs argument parsing to recover cross-chain semantics, enabling seamless tracking across ledgers. Based on the inferred semantics, AMLGuard abstracts each transaction into a DeFi Semantic Unit (DSU). We evaluate the effectiveness of AMLGuard on 82 real-world laundering cases, involving illicit assets worth over $1 billion. Specifically, AMLGuard reconstructs compact illicit fund-flow topologies with destination precision of 94.4% and 87.6%, while achieving the highest address recall of 98.4% and 95.8% and destination recall of 94.1% and 93.8% on single-chain and cross-chain datasets.
Similar to all other cryptocurrency platforms, Ethereum is constantly confronted with malicious activities. In recent years, research efforts have targeted the detection and mitigation of malicious activities and the associated accounts within the Ethereum ecosystem. Yet, the malicious accounts represent only a small visible part of the substantial collaborative network enabling these activities. In this work, we offer the first analysis of this collaborative network and the corresponding affiliate accounts that often remain hidden from detection. We present enEtherShield, an enhanced framework for detecting affiliate accounts that assist malicious accounts in the related Ethereum scams. Our research findings lay the foundation for the detection of the collaborative network enabling Ethereum scams.
The rapid expansion of U.S. financial technology platforms has created new vectors for money laundering, terrorist financing and financial crime that traditional anti-money laundering frameworks were not designed to address. This article presents a systematic literature review of 78 peer-reviewed studies published between 2015 and 2025 to examine the design, performance and policy implications of advanced anti-money laundering frameworks for U.S. fintech platforms. This study draws on evidence from financial criminology, regulatory law, computer science and organizational studies; the review finds that machine learning-based transaction monitoring systems reduce false positive alert rates by 40 to 70 percent compared to rule-based systems, as well as improving detection of sophisticated layering schemes. Blockchain analytics tools partially de-anonymize cryptocurrency transaction flows and have been used to identify illicit financial activity on major blockchain networks. Regulatory technology platforms automate suspicious activity reporting, beneficial ownership identification and customer due diligence workflows in ways that reduce compliance costs as well as improve regulatory data quality. However, the reviewed literature also documents persistent challenges, including algorithmic disparate impact in AML monitoring systems, beneficial ownership opacity through shell company structures, regulatory arbitrage between licensed exchanges and decentralized finance protocols and the systemic underutilization of suspicious activity report intelligence by law enforcement agencies. The article concludes with six evidence-based policy recommendations and a research agenda for advancing AML framework effectiveness in the rapidly evolving U.S. fintech sector. Keywords: Anti-Money Laundering, Fintech, AML Compliance, Machine Learning, Transaction Monitoring, Know Your Customer, Cryptocurrency Regulation, Regulatory Technology, Suspicious Activity Reporting, Financial Crime.
Decentralized Finance (DeFi) has suffered over $5 billion in cumulative losses from security incidents, yet the academic community lacks a large-scale, multi-source-verified dataset to systematically characterize these threats. We present DEFIHACK-824, a curated dataset of 823 DeFi security incidents spanning 2017 to 2026, cross-validated against three independent intelligence sources (Rekt News, SlowMist, and CertiK). Each record is annotated with attack category, confidence level (Gossip/Classified/Ground Truth), and estimated financial loss. We classify incidents into 14 attack categories and conduct statistical analyses: (1) flash-loan-enabled price manipulation and reentrancy together account for 51.5% of all attacks; (2) a chi-squared test rejects the null hypothesis of uniform category distribution at p < 0.0001 (chi-squared = 1,273.2, df = 13); (3) despite widespread deployment of automated detection tools, the annual attack count has not monotonically decreased. We further propose a six-layer DeFi threat model and quantify the effectiveness of four defense classes. The dataset, threat model, and 50 categorized Solidity vulnerability patterns are released under the MIT license.
Abstract The same infrastructures that enable decentralised finance, NFT markets, and metaverse platforms also create new spaces for paraâcrime. This article extends grey criminology to Web3 by applying three mechanisms of infrastructural illegality â parasitism, normative greyness, and platform coâproduction â first developed for physical crossâborder grey economies (daigou). Drawing on technical and financial crime literature, we show how smart contracts, stablecoins, and DAO governance are parasitised for money laundering and fraud; how technoâlibertarian narratives of 'code is law' and decentralisation sustain normative greyness; and how algorithmic security and DAO coâproduction reshape rather than eliminate paraâcrime. The analysis reveals both structural parallels with physical grey economies and domainâspecific variations â most notably, the deeper internalisation of coâproduction in codeâbased systems. We argue that grey criminology must extend its infrastructural turn to virtual and metaversal spaces, and that enforcement paradoxes â where suppression threatens valued infrastructures â apply as much to blockchain protocols as to customs thresholds.
Bitcoin (BTC) wealth distribution is often studied with macro indicators like wallet balances, prices, network activity, fees, and hashrate. This letter proposes a "Crypto-Microeconomic Observability Framework" to examine micro-level Bitcoin wealth disparities across five labeled agent classes: Service, Abuse, Malware, Individuals, and Benign. Using descriptive, inequality, and longitudinal concentration metrics, we show that Bitcoin wealth is highly concentrated across major classes, consistent with a persistent "Whale-Effect". Service entities hold the largest share of observed BTC (75.15%), while Abuse controls a disproportionately large share relative to its entity count (24.26% of BTC vs. 3.53% of entities). Individuals, Abuse, and Service show near-maximal within-class inequality (e.g., Gini = 0.9993 for Individuals), and time-series analysis indicates these patterns persist. Overall, Bitcoin wealth among labeled economic agents remains structurally uneven and concentrated in a small subset of entities.
Since the first implementation of a blockchain with Bitcoin in 2009, cryptoassets created and transacted using blockchain technologies have grown and diversified significantly. Because regulatory regimes, which govern cryptoassets, do not have global coverage, criminal actors find opportunities to commit cryptoasset fraud. While it can be difficult to distinguish between cryptoassets that are honest but high risk and cryptoassets that are outright fraudulent, investors seeking significant returns frequently invest in unregulated cryptoassets, namely cryptocurrencies and non-fungible tokens (NFTs). This study provides a crime script analysis to examine the chronological and functional steps offenders use to execute cryptoasset fraud. It considers three types of crypto asset fraud and how they have functioned over time: Ponzi schemes, cryptoasset exit scams, such as cryptocurrency ârug pulls,â and NFT âmint-and-runâ schemes, where invested value is stolen from a crypto asset project. By outlining the fundamental crime script of cryptoasset fraud, this study considers the implications for regulators. Of note, this study shows that while the stages of cryptoasset frauds are consistent, the speed at which frauds are executed has, on average, increased significantly. This rapidity of execution provides enduring challenges to regulators, who often cannot respond quickly. This challenge must be considered if regulation is to be effective.
This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by rekt.news, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative losses yet represent a negligible share of published audit findings. Third, realised losses exhibit extreme concentration: the eight largest incidents account for 50.6% of cumulative dollar losses and the twenty largest for 71.4%, a distributional shape inconsistent with Gaussian assumptions. Throughout, we adopt the analytical convention that audit outputs and exploit outputs describe different populations and present the two datasets in parallel rather than as directly comparable samples.
Yuanyuan Zhang, N. J. Lord, Stephen Chan, Jeffrey Chu ¡ 5 authors
This study examines the relationship between global phishing crime and cryptocurrency-market conditions, with a specific focus on Ethereum. Using monthly data from January 2016 to December 2022, we analyse the returns of global phishing crime numbers together with six Ethereum financial metrics relating to transactions, trading volume, and price impact. We employ quantile regression, quantile-on-quantile regression, and Granger causality in quantiles to examine whether the relationship between Ethereum market indicators and phishing activity varies across different market states. The results reveal a state-dependent relationship. Large increases in phishing crime numbers are strongly associated with large increases in Ethereum transaction activity, average transaction price, and transaction quantity, while implicit transaction cost is predominantly negatively associated with phishing activity, particularly at the upper quantiles. These findings suggest that phishing risk is most pronounced during extreme market conditions and may be shaped by both reward-enhancing market activity and cost-enhancing transaction frictions. To interpret these patterns, we develop an incentive-based criminogenic mechanism in which Ethereum market conditions affect phishing activity through offendersâ expected payoff. We identify two mediating channels: a monetisation-frictions channel, operating through liquidity, price impact, slippage, and transaction costs; and an attention/information-asymmetry channel, operating through volatility, speculative attention, fear of missing out, and user vulnerability. The findings provide initial evidence that cryptocurrency-related phishing is not only a technical cybersecurity issue, but also a market-sensitive phenomenon shaped by financial incentives, liquidity conditions, and behavioural vulnerability. These insights can support regulators, law enforcement agencies, and cryptocurrency platforms in developing adaptive early-warning and prevention strategies.
Kabilesh C M, Dr. B. Raja, Dr. S. Geetha, Dr. V. Cyrilraj
As decentralized finance (DeFi) continues to scale, traditional forensic methodologies often fail due to their retrospective, "post-mortem" nature, analyzing illicit activities only after they are permanently recorded on the ledger. This project proposes coinEth, a real-time institutional blockchain surveillance and autonomous defense system designed for the Ethereum Sepolia network. The framework operates across a four-layer architecture: a Data Acquisition Layer that intercepts pending transactions via Alchemy WebSockets (WSS); a Persistence and Forensic Engine that utilizes SQLite and Python-based heuristics to detect suspicious behavioral patterns such as "structuring" and "high velocity"; a Governance Layer that executes an autonomous enforcement loop via a Solidity-based "Gatekeeper" smart contract; and a Visualization Layer built with Streamlit and PyVis. By assigning dynamic risk scoresâcategorized as Safe (Level 0), Warning (Level 1), and Frozen (Level 2)âthe system can automatically broadcast on-chain transactions to freeze illicit accounts before fund exfiltration occurs. Furthermore, coinEth reconstructs a chronological "money trail" through sequential path mapping (T0 â T1 â T2...), ensuring a verifiable digital chain of custody for investigative reporting. This proactive approach shifts blockchain security from passive observation to active, real-time intervention, significantly enhancing the defense mechanisms available to institutional stakeholders.