Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LOCARD: An Agentic Framework for Blockchain Forensics

Xiaohang Yu, William Knottenbelt

Abstract

Blockchain forensics inherently involves dynamic and iterative investigations, while many existing approaches primarily model it through static inference pipelines. We propose a paradigm shift towards Agentic Blockchain Forensics (ABF), modeling forensic investigation as a sequential decision-making process. To instantiate this paradigm, we introduce LOCARD, the first agentic framework for blockchain forensics. LOCARD operationalizes this perspective through a Tri-Core Cognitive Architecture that decouples strategic planning, operational execution, and evaluative validation. Unlike generic LLM-based agents, it incorporates a Structured Belief State mechanism to enforce forensic rigor and guide exploration under explicit state constraints. To demonstrate the efficacy of the ABF paradigm, we apply LOCARD to the inherently complex domain of cross-chain transaction tracing. We introduce Thor25, a benchmark dataset comprising over 151k real-world cross-chain forensic records, and evaluate LOCARD on the Group-Transfer Tracing task for dismantling Sybil clusters. Validated against representative laundering sub-flows from the Bybit hack, LOCARD achieves high-fidelity tracing results, providing empirical evidence that modeling blockchain forensics as an autonomous agentic task is both viable and effective. These results establish a concrete foundation for future agentic approaches to large-scale blockchain forensic analysis. Code and dataset are publicly available at https://github.com/xhyumiracle/locard and https://github.com/xhyumiracle/thorchain-crosschain-data.

LOCARD: An Agentic Framework for Blockchain Forensics

Abstract

Blockchain forensics inherently involves dynamic and iterative investigations, while many existing approaches primarily model it through static inference pipelines. We propose a paradigm shift towards Agentic Blockchain Forensics (ABF), modeling forensic investigation as a sequential decision-making process. To instantiate this paradigm, we introduce LOCARD, the first agentic framework for blockchain forensics. LOCARD operationalizes this perspective through a Tri-Core Cognitive Architecture that decouples strategic planning, operational execution, and evaluative validation. Unlike generic LLM-based agents, it incorporates a Structured Belief State mechanism to enforce forensic rigor and guide exploration under explicit state constraints. To demonstrate the efficacy of the ABF paradigm, we apply LOCARD to the inherently complex domain of cross-chain transaction tracing. We introduce Thor25, a benchmark dataset comprising over 151k real-world cross-chain forensic records, and evaluate LOCARD on the Group-Transfer Tracing task for dismantling Sybil clusters. Validated against representative laundering sub-flows from the Bybit hack, LOCARD achieves high-fidelity tracing results, providing empirical evidence that modeling blockchain forensics as an autonomous agentic task is both viable and effective. These results establish a concrete foundation for future agentic approaches to large-scale blockchain forensic analysis. Code and dataset are publicly available at https://github.com/xhyumiracle/locard and https://github.com/xhyumiracle/thorchain-crosschain-data.

Paper Structure

This paper contains 67 sections, 23 equations, 5 figures, 1 table.

Table of Contents

  1. Introduction
  2. Blockchain forensics and transaction tracing.
  3. Cross-chain forensics and emerging challenges.
  4. Limitations of static forensic pipelines.
  5. Toward agentic blockchain forensics.
  6. Problem Modeling
  7. Preliminaries
  8. Chains, assets and bridges.
  9. On-chain transfers.
  10. Same-chain predecessor relation.
  11. Cross-chain transfer links.
  12. Cross-chain Tracing Tasks
  13. Single-Transfer Tracing
  14. Group-Transfer Tracing
  15. Agentic Blockchain Forensics Paradigm
  16. ...and 52 more sections

Figures (5)

  • Figure 1: LOCARD: Agentic Blockchain Forensics Framework
  • Figure 2: Cross-chain Transaction through a Bridge
  • Figure 3: LOCARD's Tri-Core Architecture
  • Figure 4: A Workflow Instantiation of LOCARD for Transaction Tracing. (a) Single-transfer cross-chain tracing workflow. (b) Group-transfer cross-chain tracing workflow.
  • Figure 5: LOCARD reconstructs a subflow of Bybit hack money laundering. (Only partial false tracing results are presented for simplicity)