RiskTagger: An LLM-based Agent for Automatic Annotation of Web3 Crypto Money Laundering Behaviors

2025-10-12

AI Summary

In Web3 environments, cryptocurrency money laundering exhibits high concealment and cross-chain complexity, while existing anti-money laundering (AML) dataset construction relies heavily on manual annotation—resulting in low efficiency and limited coverage. Method: This paper proposes RiskTagger, an LLM-powered automated labeling agent, implemented as an end-to-end multi-module agent framework integrating suspicious clue extraction, cross-chain data acquisition, money laundering behavior reasoning, and explainable label generation. Contribution/Results: RiskTagger is the first to deeply couple LLM-driven reasoning and explainability generation across the entire on-chain transaction path analysis pipeline. Evaluated on the Bybit hack incident, it achieves 100% clue extraction accuracy, 84.1% agreement with expert judgments, and 90% explanation coverage. The approach significantly enhances AML dataset construction efficiency, scalability, and audit transparency, providing a scalable methodology for on-chain AML research.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Humans and AI: Human-in-the-loop Machine Learning

Application Category

• Economics, Online Markets and Human Computation: Humans versus LLMs for data annotation and labeling
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

While the rapid growth of Web3 has driven the development of decentralized finance, user anonymity and cross-chain asset flows make on-chain laundering behaviors more covert and complex. In this context, constructing high-quality anti-money laundering(AML) datasets has become essential for risk-control systems and on-chain forensic analysis, yet current practices still rely heavily on manual efforts with limited efficiency and coverage. In this paper, we introduce RiskTagger, a large-language-model-based agent for the automatic annotation of crypto laundering behaviors in Web3. RiskTagger is designed to replace or complement human annotators by addressing three key challenges: extracting clues from complex unstructured reports, reasoning over multichain transaction paths, and producing auditor-friendly explanations. RiskTagger implements an end-to-end multi-module agent, integrating a key-clue extractor, a multichain fetcher with a laundering-behavior reasoner, and a data explainer, forming a data annotation pipeline. Experiments on the real case Bybit Hack (with the highest stolen asset value) demonstrate that RiskTagger achieves 100% accuracy in clue extraction, 84.1% consistency with expert judgment, and 90% coverage in explanation generation. Overall, RiskTagger automates laundering behavior annotation while improving transparency and scalability in AML research.

Problem

• Automating annotation of crypto money laundering in Web3
• Addressing covert and complex on-chain laundering behaviors
• Replacing manual efforts with scalable risk-control systems

Innovation

• LLM-based agent automates crypto laundering annotation
• Multi-module pipeline extracts clues and reasons transactions
• Generates auditor-friendly explanations for laundering behaviors