RiskTagger: An LLM-based Agent for Automatic Annotation of Web3 Crypto Money Laundering Behaviors

TL;DR

RiskTagger tackles the challenge of labeling Web3 money laundering by deploying an LLM-driven agent that automatically extracts key clues from unstructured reports, traces laundering paths across multiple blockchains, and generates auditor-friendly explanations. The three-module architecture—Key-clue Extractor, Laundering Tracer, and Dataset Explainer—leverages CoT reasoning and a reflection mechanism to mitigate hallucinations and improve traceability. On the Bybit Hack, the Extractor Attains $100\%$ accuracy, the Reasoner achieves $84.1\%$ agreement with expert judgments, and the Explainer delivers $90\%$ coverage for generated reports, demonstrating strong information extraction, risk assessment consistency, and report quality. This work provides a scalable, transparent workflow for automated AML annotation in Web3, with open-source resources that support reproducibility and real-world forensic applications.

Abstract

While the rapid growth of Web3 has driven the development of decentralized finance, user anonymity and cross-chain asset flows make on-chain laundering behaviors more covert and complex. In this context, constructing high-quality anti-money laundering(AML) datasets has become essential for risk-control systems and on-chain forensic analysis, yet current practices still rely heavily on manual efforts with limited efficiency and coverage. In this paper, we introduce RiskTagger, a large-language-model-based agent for the automatic annotation of crypto laundering behaviors in Web3. RiskTagger is designed to replace or complement human annotators by addressing three key challenges: extracting clues from complex unstructured reports, reasoning over multichain transaction paths, and producing auditor-friendly explanations. RiskTagger implements an end-to-end multi-module agent, integrating a key-clue extractor, a multichain fetcher with a laundering-behavior reasoner, and a data explainer, forming a data annotation pipeline. Experiments on the real case Bybit Hack (with the highest stolen asset value) demonstrate that RiskTagger achieves 100% accuracy in clue extraction, 84.1% consistency with expert judgment, and 90% coverage in explanation generation. Overall, RiskTagger automates laundering behavior annotation while improving transparency and scalability in AML research.

Figures (11)

• Figure 1: Name tag of Account https://etherscan.io/address/0x47666fab8bd0ac7003bce3f5c3585383f09486e2 (Bybit Exploit 1) by Etherescan
• Figure 2: Overview of RiskTagger, an LLM-based agent for automatic annotation of Web3 crypto money laundering behaviors.
• Figure 3: Overview of the key-clue extractor.
• Figure 4: CoT prompt template of Reasoner (Part I).
• Figure 5: CoT prompt template of Reasoner (Part II).