PaperlayerView exact revision on arXiv

Source-linked AI summary

Tracing Money Laundering Across DeFi, Bridges, and Mixers on Ethereum

Huan Xing, Gaohe Jin, Bang Fu, Yue Li, Baoning Niu, Xing Fan

arXiv:2610.32210v1cs.CR

TL;DR

Mixers break the direct on-chain linkage between assets entering and leaving the service, so their subsequent movement cannot be directly traced. FPTracer recovers intra-transaction paths with CATT, classifies cross-chain intent from asset-flow and execution evidence, and uses upstream network evidence to flag potential post-mixer activity. On the 10 cases with labeled laundering traces, FPTracer achieved the highest recall among compared methods, identifying 98.6% of labeled laundering addresses and 94.2% of labeled laundering destinations.

  • Problem

    Mixers break the direct on-chain linkage between assets entering and leaving the service, so their subsequent movement cannot be directly traced.

    Source: §I · p. 2

  • Method

    FPTracer recovers intra-transaction paths with CATT, classifies cross-chain intent from asset-flow and execution evidence, and uses upstream network evidence to flag potential post-mixer activity.

    Source: §I · p. 2

  • Results

    On the 10 cases with labeled laundering traces, FPTracer achieved the highest recall among compared methods, identifying 98.6% of labeled laundering addresses and 94.2% of labeled laundering destinations.

    Source: §I · p. 2

  • Takeaways & Limitations

    The evaluation highlights the value of combining path-aware tracing with bridge and mixer analysis for more comprehensive laundering analysis on Ethereum.

    Source: §VI · p. 11

Abstract

from arXiv · show

Illicit actors exploit Ethereum's deep liquidity and diverse on-chain services to launder criminal proceeds by combining decentralized finance (DeFi) protocols, cross-chain bridges, and mixers in multi-stage processes. Existing anti-money laundering tracing methods fail to disentangle the underlying asset-flow paths in complex transactions, potentially misdirecting subsequent tracing; cannot identify cross-chain intent without pre-collected bridge information; and treat mixers as generic exit services, overlooking post-mixer laundering flows. We present FPTracer, a framework for tracing illicit assets across Ethereum services. First, we propose a method based on the Context-Aware Transfer Tree (CATT) to recover intra-transaction asset-flow paths, which guide accurate tracing and service analysis. Second, we extract discriminative features from asset-flow and execution-evidence perspectives and train a classifier to identify transactions with cross-chain intent. Third, we leverage evidence from the upstream laundering network to analyze potential post-mixer laundering activities. Evaluation on 20 real-world laundering cases demonstrates FPTracer's effectiveness. It achieves the highest recall for both known laundering addresses (98.6%) and destinations (94.2%). It identifies all known uses of bridges in these cases and uncovers 30 previously unreported ones. Among 18 cases with identified Tornado Cash usage, FPTracer can identify potential withdrawal-side activities, which are corroborated by public reports where available.

I. INTRODUCTION

Ethereum laundering can combine DeFi, bridges, and mixers, while existing tracing methods struggle with complex transaction paths, cross-chain intent, and post-mixer activity. FPTracer addresses these gaps with path-aware tracing and service analysis, evaluated across real-world laundering cases.

I. INTRODUCTION

  • CATT combines raw transfers with transaction execution structure to recover intra-transaction asset-flow paths without prior contract-specific knowledge.Existing methods can miss or misdirect downstream tracing because raw transfers obscure paths through intermediary contracts and asset conversions.Source: §I · p. 2
  • A learning-based classifier uses asset-flow and execution patterns to identify cross-chain intent without manually curated bridge-specific information.Bridge designs lack a unified interaction pattern, and bridge entry can occur through proxy contracts or within transactions resembling ordinary DeFi activity.Source: §I · p. 2
  • Evidence from the preceding laundering network is used to flag potential post-mixer laundering activities rather than treating mixers only as exit services.Mixers break the direct on-chain link between incoming and outgoing assets, interrupting ordinary tracing.Source: §I · p. 2
  • 98.6% of labeled laundering addresses and 94.2% of labeled destinations were identified with the highest recall among compared methods.Across 20 cases, FPTracer identified all publicly reported bridge uses and 30 additional uses; it identified potential Tornado Cash withdrawal-side activity in 7 cases.Source: §I · p. 2

II. BACKGROUND

Ethereum transactions execute through nested contract calls, within which asset transfers and other state changes can occur. The section describes four service-provider types relevant to laundering and explains Tornado Cash's deposit and withdrawal workflow.

A. Transaction Execution Model on Ethereum.

  • Transactions initiated by externally owned accounts can trigger nested calls to contracts, with asset transfers occurring during execution.ETH transfers can occur through calls carrying value, while token transfers are executed by contracts and commonly recorded in standardized Transfer events.Source: A. Transaction Execution Model on… · pp. 2–3

B. On-chain Service Providers.

  • The paper treats DeFi protocols, cross-chain bridges, mixers, and centralized exchanges as service providers requiring distinct tracing treatment.These providers receive assets as part of service interactions; centralized exchanges may serve as exit services, after which investigation generally shifts off-chain.Source: B. On-chain Service Providers · p. 3
  • Tornado Cash deposits enter fixed-denomination pools, while withdrawals may use a fresh address or relayer and do not directly link on-chain to the depositor.The relayer can pay the gas fee and receive a fee, while the withdrawn assets go to the user-specified recipient.Source: B. On-chain Service Providers · p. 3

III. METHODOLOGY OF FPTRACER

FPTracer follows illicit assets from known source addresses by recovering transaction-level paths and expanding a laundering network. It then applies service-specific analysis to identify bridge deposits and potential mixer withdrawal activity.

A. Overview

  • FPTracer builds a CATT, recovers Asset Tracking Paths using structural constraints and value continuity, and follows tracked assets’ destinations to expand the laundering network.Network expansion stops at service-provider boundaries so applicable service-specific analysis can be invoked.Source: A. Overview · p. 3, Figure 3 · p. 4

M2 Cross-chain Deposit Transaction Identification

  • For cross-chain deposit identification, FPTracer extracts asset-flow and execution-evidence features, including event logs and storage changes, and applies a learned classifier.The features support identifying whether a transaction involving tracked assets represents a bridge deposit.Source: M2 Cross-chain Deposit Transaction… · p. 4

M3 Mixer Interaction Analysis

  • For mixer analysis, FPTracer identifies Tornado Cash deposits from ATP destinations and uses implementation details plus upstream laundering-network evidence to flag potential withdrawal transactions.Source: M2 Cross-chain Deposit Transaction… · p. 4

B. Path-Aware Laundering Tracing

FPTracer recovers transaction-level asset-flow paths by combining transfers with their execution context in a CATT, then associating transfers that represent the same value flow. The resulting paths capture conversions, mint/burn boundaries, and split or merged flows.

1) Intra-transaction Asset-flow Path Recovery:

  • CATT construction links each asset transfer to its call context and execution order, pruning calls that neither transfer assets nor contain asset-transferring descendants.Message-call nesting provides the tree structure; transfer nodes connect to the call in which they occur.Source: M3 Mixer Interaction Analysis · p. 4, 1) Intra-transaction Asset-flow Path… · p. 4
  • Each transfer begins as an atomic ATP; postorder traversal associates paths within local call contexts before combining them across broader contexts.The recovered ATP set is retained under the root call node.Source: M3 Mixer Interaction Analysis · pp. 4–5, Figure 4 · p. 6
  • R1 matches same-asset continuity through a common address, including splitting a larger destination amount or accumulating compatible preceding entries when needed.A cumulative match is made only if the compatible entries reach the source amount.Source: M3 Mixer Interaction Analysis · p. 5
  • R2 associates adjacent paths across asset conversions, while R3 captures value continuity across mint and burn boundaries.R3 considers candidate ATPs with one source and one destination; mint and burn associations use contiguous groups of normal ATPs.Source: M3 Mixer Interaction Analysis · pp. 5–6

M3 Mixer Interaction Analysis

  • The example applies R2, R3-Burn, then R1 to merge five raw transfers into a recovered path.The example uses shared addresses and equal USD value for the conversion association, then burn-related and same-asset continuity associations.Source: M3 Mixer Interaction Analysis · p. 6, Figure 4 · p. 6

2) ATP-guided Laundering Network Expansion:

The expansion algorithm uses recovered ATPs to trace downstream flows from known illicit sources and build a laundering graph. It stops expansion at known services or addresses meeting the selected stopping criterion.

2) ATP-guided Laundering Network Expansion:

  • For each traced address, the algorithm examines later outflow transactions, recovers ATPs sourced from that address, and adds edges to their destination addresses.The queue starts from the illicit source set, with each source paired with its starting block number.Source: 2) ATP-guided Laundering Network… · p. 6
  • Destinations identified as service providers or meeting the stopping criterion become tracing boundaries; other destinations are queued for further expansion.The stopping criterion is instantiated according to the evaluation setting.Source: 2) ATP-guided Laundering Network… · p. 6
  • The returned graph records downstream laundering flows and the boundaries reached during expansion.A visited-transaction set prevents repeated processing.Source: 2) ATP-guided Laundering Network… · p. 6

C. Cross-chain Deposit Transaction Identification

FPTracer classifies whether a service-provider-related transaction carries tracked illicit assets into a bridge using asset-flow and execution evidence. Its features capture transaction-level path distribution and ATP-level path, destination, behavior, and execution signals.

C. Cross-chain Deposit Transaction Identification

  • FPTracer combines four feature groups from asset flows and execution evidence to classify whether a service-provider-related transaction carries tracked illicit assets into a bridge.Bridge deposits commonly expose user-related cross-chain information in event logs, while single-chain DeFi interactions often maintain user-related storage state.Source: C. Cross-chain Deposit Transaction… · p. 7
  • Path distribution features measure recovered-path count and value concentration using normalized HHI, with a single-path transaction assigned HHInorm = 1.A larger normalized HHI indicates that transferred value is concentrated in one or fewer dominant paths.Source: C. Cross-chain Deposit Transaction… · p. 7
  • Asset-flow features describe ATP structure, destination semantics, and asset semantics, while destination-behavior features summarize historical activity and transfer volume, including a 30-day window.Asset semantics include the last-hop asset type and number of asset conversions.Source: C. Cross-chain Deposit Transaction… · p. 7
  • Execution-state features count nonstandard event logs and detect potential user-related storage updates in the last-hop call context, but the storage heuristic does not recover the complete schema.The four groups are combined by weighting ATP-level features by each path’s value share and concatenating them with transaction-level features.Source: C. Cross-chain Deposit Transaction… · pp. 7–8

D. Mixer Interaction Analysis

FPTracer identifies Tornado Cash deposits from ATP destinations, then uses the upstream laundering network to flag potential withdrawal-side activity. The candidates are evidence-based but do not establish deterministic deposit-to-withdrawal correspondences.

D. Mixer Interaction Analysis

  • These withdrawal-side candidates provide forensic leads but do not establish deterministic correspondences between individual deposits and withdrawals.Source: D. Mixer Interaction Analysis · p. 8
  • A service-provider-related transaction is labeled a Tornado Cash deposit when an ATP ends at a known pool and matches its fixed denomination and asset type.The pool contracts are collected from official documentation.Source: D. Mixer Interaction Analysis · p. 8
  • Withdrawal analysis considers pool withdrawals from the earliest deposit through the latest deposit plus a delay window.The window is defined separately for each pool.Source: D. Mixer Interaction Analysis · p. 8
  • Withdrawals are retained as candidates when the withdrawer or nearby downstream flows connect to addresses in the upstream laundering network, or when cross-pool deposit and withdrawal counts match.The rules include prior interactions with network addresses, downstream flows up to two transfer hops, and matching counts across pools.Source: D. Mixer Interaction Analysis · p. 8

IV. EVALUATION

The evaluation asks whether FPTracer recovers within-transaction asset-flow paths, expands laundering networks, identifies cross-chain deposits, and finds post-mixer laundering flows.

  • RQ1 tests how accurately FPTracer recovers underlying asset-flow paths in laundering transactions.Source: §IV · p. 8
  • RQ2 evaluates FPTracer’s effectiveness in expanding laundering networks.Source: §IV · p. 8
  • RQ3 tests how accurately FPTracer identifies cross-chain deposit transactions during laundering tracing.Source: §IV · p. 8
  • RQ4 asks whether FPTracer can identify post-mixer laundering flows effectively.Source: §IV · p. 8

A. Evaluation Setup

The evaluation compares FPTracer with tracing approaches on network expansion and cross-chain identification, using real-world cases and task-specific benchmarks.

  • FPTracer is compared with XBlockFlow and AMLGuard-Public for network expansion, while cross-chain identification is compared with AMLGuard-Public.The released AMLGuard artifact lacks the DeFi operation knowledge base required by its RAG inference component, so the executable rule-based workflow is evaluated as AMLGuard-Public.Source: A. Evaluation Setup · p. 8
  • The case-level evaluation uses 20 laundering incidents from 2019–2025, with Ethereum execution records collected for each case.Records include calls, transfers, event logs, and storage changes.Source: A. Evaluation Setup · p. 8
  • Task-specific benchmarks use manually annotated paths for RQ1, overlapping labeled traces for RQ2, and a transaction-level benchmark for RQ3.For case-level bridge and mixer analyses, public reports and manual verification serve as reference evidence because comprehensive public benchmarks are unavailable.Source: A. Evaluation Setup · pp. 8–9

B. RQ1: Results of Intra-transaction Path Recovery

FPTracer recovers nearly all manually annotated intra-transaction paths and achieves high laundering-network coverage, with the two path-recovery failures tied to uncommon protocol execution design.

B. RQ1: Results of Intra-transaction Path Recovery

  • The path-recovery benchmark comprises 300 randomly sampled laundering transactions with at least two asset transfers, manually annotated as ground truth.Source: B. RQ1: Results of Intra-transaction… · p. 9
  • 99.33% TER reflects exact recovery of 298 of 300 manually annotated transactions.Both failures involve uncommon protocol execution design; Sky LitePSM routes input and output assets through different contracts, violating R2’s shared-intermediate-address condition and fragmenting the recovered path.Source: B. RQ1: Results of Intra-transaction… · p. 9

C. RQ2: Results of Laundering Network Tracing

  • Recall measures recovered labeled laundering addresses, while D-Recall measures labeled laundering destinations reached during tracing.Source: C. RQ2: Results of Laundering Network… · p. 9
  • 98.6% Recall and 94.2% D-Recall are achieved by FPTracer on laundering-network tracing.XBlockFlow has lower coverage because it does not explicitly reconstruct continuous asset-flow paths; AMLGuard-Public has higher coverage but fails on mint/burn transformations or execution-context constraints.Source: C. RQ2: Results of Laundering Network… · p. 9

D. RQ3: Effectiveness of Cross-Chain Deposit Transaction Identification

FPTracer evaluates cross-chain deposit classification on a labeled benchmark and bridge identification in laundering cases. It recovers all reported case–bridge pairs and verifies 30 additional pairs.

1) Evaluation of M2.:

  • The labeled Bbridge benchmark contains 8,533 cross-chain deposits from 28 bridge protocols and 8,441 non-deposit transactions.Non-deposit examples include CEX-related transactions, bridge-related non-deposit interactions, and single-chain DeFi interactions.Source: 1) Evaluation of M2 · p. 9
  • All classifiers except DT exceed 98% F1 in the address-disjoint evaluation, with XGBoost highest in recall, accuracy, and F1 while maintaining high precision.In bridge-disjoint tests, all except DT exceed 97% F1; greater standard deviations indicate sensitivity to held-out bridge choice and design differences.Source: 1) Evaluation of M2 · p. 9, Table IV · p. 10

2) Evaluation of FPTracer’s Cross-Chain Deposit Identification.:

  • The case-level comparison uses case–bridge pairs, counting each unique case and bridge combination once regardless of transaction count.Reported-pair coverage measures the proportion of publicly reported case–bridge pairs recovered; collected public reports are not exhaustive.Source: 2) Evaluation of FPTracer’s… · p. 10
  • 100% RPC is achieved by FPTracer for reported case–bridge pairs, and 30 additional pairs are manually validated with on-chain evidence.FPTracer identifies bridge usage in 10 cases; evidence checks include tracing deposits to labeled laundering addresses, bridge explorers where available, and contract, function-signature, and event semantics.Source: 2) Evaluation of FPTracer’s… · p. 10, Table V · p. 10

E. RQ4: Results of Mixer Interaction Analysis

FPTracer identifies Tornado Cash deposits across most laundering cases and finds candidate withdrawal-side activity in seven cases, with public evidence corroborating subsets in two. The paper situates this analysis among prior AML tracing, bridge-identification, and mixer studies, and concludes that combining path-aware tracing with bridge and mixer analysis supports more comprehensive laundering analysis on Ethereum.

E. RQ4: Results of Mixer Interaction Analysis

  • FPTracer identifies Tornado Cash deposits in 18 of 20 cases, totaling 4,253 transactions and 405,374.9 ETH; the 100-ETH pool accounts for 4,039 deposits (94.97%) and 403,900 ETH (99.64%).The deposits span all four ETH-denominated pools: 0.1, 1, 10, and 100 ETH.Source: E. RQ4: Results of Mixer Interaction… · p. 10
  • Withdrawal-side candidates are identified in seven of the 18 deposit cases, with public reports corroborating 222 of 442 KucoinHacker candidates and 47 of 82 LiquidHacker candidates.Because no on-chain ground truth reveals true deposit–withdrawal correspondences, the remaining candidates are not treated as false positives; public evidence is not exhaustive.Source: E. RQ4: Results of Mixer Interaction… · p. 10

V. RELATED WORK

  • Prior work studies illicit accounts, transaction graphs, laundering groups, asset tracing, bridge signals, and mixer linkability or deposit–withdrawal associations,, –.Bridge-identification approaches may depend on maintained protocol information, while some learning methods are evaluated on known bridge protocols or contracts [12],,, [36]–.Source: §V · pp. 10–11

VI. CONCLUSION

  • Across 20 real-world laundering cases, FPTracer combines CATT-based path recovery, cross-chain-intent identification, and mixer analysis for more comprehensive Ethereum laundering analysis.It uses recovered asset-flow paths to guide laundering-network expansion and analyzes mixer interactions for potential withdrawal-side activity.Source: §VI · p. 11
Loading 2610.32210v1…