Multi-hop laundering
Peeling chains, mixers and bridges dilute a straightforward trail.
SIH 26182 · Ministry of Home Affairs / I4C
Trace the money.
Identify the exit.
Preserve the evidence.
SAHYOG is an explainable multi-chain investigation system that follows tainted cryptocurrency through wallets, mixers and bridges, ranks the likely VASP off-ramp, and prepares a reviewable legal case package.
15 hopsmaximum controlled tracing depth
3 chainsEVM, Bitcoin and TRON coverage
2 modelsattribution plus AML anomaly inference
1 dossiergraph, attribution, risk and legal evidence
01 — Why this matters
Crypto investigations break where money becomes anonymous again.
A criminal can split, bridge, mix and relay funds through dozens of wallets before depositing at an exchange. Investigators need more than a transaction list: they need a defensible trail to an off-ramp and a lawful path to request KYC records or freeze assets.
“Develop an automated, AI-driven crypto-investigation framework capable of tracking tainted cryptocurrency across multiple hops, identifying exit gateways, generating statutory requisitions, and presenting tamper-evident evidence.”
Pseudonymous exits
Off-ramp wallets must be linked to a VASP before KYC can be sought.
Admissibility gap
A result must be accompanied by an explainable and sealed evidence record.
Fragile data access
Tracing cannot stop because one explorer has a rate limit or outage.
02 — Global scale & India context
Illicit value is a small share of crypto activity—and still a vast investigative workload.
These figures use different scopes and should not be added together. Together, they show why tracing, attribution and rapid freezing workflows matter.
A lower-bound estimate; historical address discovery could move the total closer to $51B.
Chainalysis, 2025 ↗Known on-chain scam addresses; the estimate may exceed $12B as more addresses are identified.
Chainalysis, 2025 ↗149,686 complaints referencing cryptocurrency, with reported losses up 66% year over year.
FBI IC3, 2024 ↗INTERPOL reported 5,811 arrests, 142,000+ identified victims and $293M in intercepted assets.
INTERPOL, 2026 ↗From 2021–2025, India’s reporting infrastructure recorded more than 6.58 million financial-fraud complaints, over ₹55,050 crore reported, ₹8,189 crore marked as lien and more than 195,760 FIRs.SOURCE · MINISTRY OF HOME AFFAIRS / PIB · JULY 2026 ↗
03 — Objectives & scope
Automate the repetitive work. Keep judgement visible.
SAHYOG is designed to accelerate a trained investigator, not replace the legal and factual decisions they are responsible for.
✓
Trace a suspect wallet across EVM, Bitcoin and TRON data sources.
✓
Reduce a large transaction neighbourhood into explainable candidate paths.
✓
Combine known VASP clusters with sanctions and threat intelligence.
✓
Rank likely off-ramps while showing confidence and competing candidates.
✓
Escalate low-confidence conclusions instead of silently over-claiming.
✓
Preserve graph evidence, risk signals and audit history for review.
IN CURRENT SCOPE
- Multi-hop transaction graph construction
- VASP, mixer, bridge and sanctions resolution
- Path-quality and graph-model scoring
- Cases, alerts, graph explorer and reports UI
- SAHYOG-compatible notice payload simulation
- Neo4j with an in-memory fallback path
NOT A CLAIM OF CURRENT CAPABILITY
- Guaranteed identification of a wallet owner
- Automatic recovery, seizure or account freezing
- Perfect tracing through privacy or off-chain systems
- Production access to every proprietary intelligence feed
- Unreviewed dispatch to a live government endpoint
- Legal admissibility without officer and counsel review
04 — The current implemented flow
From wallet input to an investigator-reviewed VASP request.
This reflects the current backend route and UI: collect deeply, reduce the graph, keep evidence streams separate, then present the shortest defensible route.
01
Case initiation
Input: case ID, suspect wallet, chain, case type and investigator. The backend detects the chain when none is supplied.
02
Deep chain crawl
Collection:
trace_multi_hop() follows transactions up to 15 hops and 2,000 addresses, using chain-specific sources and offline fallback data.03
Graph construction
Structure: addresses become nodes and transfers become directed edges. Neo4j is used when available; in-memory traversal preserves the workflow when it is not.
04
Prune & extract
Reduction: noise is pruned and candidate shortest paths to exchange/VASP nodes are extracted with cycle protection and a 15-edge ceiling.
05
Resolve entities
Ground truth: known VASP clusters, mixers, bridges and sanctions signals are attached before any probabilistic attribution is considered.
06
Score routes
Forensics: candidate paths are evaluated for value continuity and evidence degradation caused by mixers, bridges and suspicious movement patterns.
07
Run dual AI
Inference: behavioural graph features feed TH-GNN VASP attribution and TransactionGCN AML risk scoring.
08
Threat enrichment
Context: OFAC, GoPlus and configured sources add risk indicators which become investigator-facing alerts.
09
Evidence fusion
Decision support: deterministic matches, GNN probability and path quality produce a ranked VASP result; ambiguity can trigger abstention.
10
Persist & present
Case output: the API stores a pruned UI graph, attribution record, audit log and risk alerts for the React workbench.
11
Review & act
Human action: an officer reviews the route and can prepare a Section 94 VASP data request. The current project simulates dispatch when no live SAHYOG endpoint is configured.
Observed transactions, deterministic matches, learned inference and officer action remain distinguishable throughout the case.
05 — System architecture
Six layers, from investigator input to evidence preservation.
The platform separates collection, graph compute, model inference, decision-making and storage so each piece can be inspected, scaled or replaced independently.
01 / Presentation
React + ViteCase intake and FIR metadata
Graph explorerCytoscape transaction workbench
Risk dashboardIntel, scoring and alerts
Legal previewNotice and PDF review
02 / Orchestration
FastAPIValidated async investigation API
Case routesCases, alerts and audit events
Intel routesThreat intelligence queries
SAHYOG dispatchNotice dispatch workflow
03 / Ingestion
EVM crawlerEtherscan / Blockscout cascade
Bitcoin crawlerUTXO unnesting + traversal
TRON crawlerTRC-20 transaction tracking
Offline cacheResilient forensics fallback
04 / Intelligence
Graph engineNeo4j or NetworkX traversal
Path scorerContinuity and obfuscation signals
TH-GNN8-class VASP attribution
TransactionGCNIllicit activity probability
05 / Decision
Entity resolverKnown VASP clusters
Threat intelOFAC and security checks
Evidence fusionWeighted final attribution
Uncertainty gateAbstain when ambiguous
06 / Persistence
Case databaseSQLite / PostgreSQL records
Neo4j storePersistent transaction graph
Model registryPyTorch checkpoints
Evidence vaultSealed PDFs and hashes
06 — A case, explained visually
SAHYOG follows the money—not merely the address.
This is the investigator’s mental model: trace outward, reduce the graph to meaningful paths, attach independent evidence, then package the result for action.
07 — What happens inside the investigation
Every result is built from evidence streams that can be inspected.
Validate and register the case
The system checks the address against chain-specific formats, records case metadata, and starts an immutable audit trail.
CASE + ADDRESS VALIDATIONTrace with controlled breadth
BFS expands the fund trail up to 15 hops, caps fan-out to prevent exchange-wallet explosions, and falls back across explorer APIs or local cache.
EVM · BTC · TRONCut the graph down to signal
Dust, leaves and peripheral transfers are pruned. Directed candidate paths from suspect wallet to potential VASP exits are retained.
NEO4J / NETWORKXAttach known-world context
Wallets are checked against verified exchange clusters, OFAC sanctions data, drainer and malicious-contract intelligence, and FIU-linked VASPs.
VASP + SANCTIONS INTELLIGENCEMeasure whether the money trail holds
Path scoring rewards coherent movement and records uncertainty introduced by peeling chains, mixers, tumbler hops and cross-chain bridges.
FORENSIC PATH QUALITYExplain the output before acting
Evidence is fused into a ranked attribution. Low score or low top-two margin triggers analyst review instead of an automatic legal action.
HUMAN-IN-THE-LOOP GATE08 — Model and decision layer
Two models, one fusion rule, and a visible uncertainty threshold.
TH-GNN
Temporal heterogeneous graph learning maps wallets, VASPs and mixers into a typed graph. It produces VASP attribution probabilities across eight known exchange classes.
Output: P(VASP | graph, behaviour)
TransactionGCN
A graph convolutional model trained against the Elliptic benchmark estimates illicit-activity risk from topology and transaction-level patterns.
Output: P(illicit | graph)
Evidence fusion
Exact matching, learned attribution and path quality remain separate until the last stage. Entropy and top-two margin decide whether the system can recommend action.
0.50 deterministic + 0.30 GNN + 0.20 path
09 — Related news / multi-hop case
BYBIT THEFT · FEBRUARY 2025$1.5BAPPROXIMATE VALUE REPORTED BY THE FBI
Thousands of addresses. Multiple blockchains. One urgent attribution problem.
The FBI attributed the Bybit theft to North Korea’s TraderTraitor activity. Its public alert says the actors converted some stolen assets to Bitcoin and other virtual assets, dispersed them across thousands of addresses on multiple blockchains, and were expected to continue laundering toward fiat conversion.
Exchange theft→Fresh wallets→Asset swaps→Multiple chains→Thousands of addresses→VASP cash-out
FBI public service announcement, 26 February 2025 ↗
How SAHYOG maps to this pattern
Multi-chain crawlers reconstruct the transaction neighbourhood; graph pruning isolates coherent fund corridors; threat intelligence flags actor-linked addresses; route scoring records bridge and mixer uncertainty; VASP attribution prioritises the cash-out point where lawful intervention is possible.
10 — Previous scams & laundering patterns
The recurring playbook is layering, mixing, chain-hopping and cash-out.
These cases show why a useful system must track paths and services—not merely flag the starting wallet.
120,000 BTC moved through extensive layering
The US Department of Justice described mixers, non-compliant exchanges, darknet markets and domestic and overseas bank accounts in the laundering plan.
DOJ case overview ↗More than $3B processed by a darknet mixer
Authorities said the service commingled Bitcoin to make criminal proceeds harder to trace, supporting ransomware, fraud, darknet and hacking activity.
DOJ takedown ↗“Ricochet” deliberately added intermediate hops
The DOJ alleged that the feature introduced unnecessary transactions to make source recognition harder for exchanges and investigators.
DOJ announcement ↗The allegations, legal status and outcomes differ by case; the linked official material provides the precise context.
11 — What the investigator receives
Not a score. A case package.
SAHYOG turns a complex trace into materials investigators can review, communicate and preserve.
⌘
Interactive graph
Trace wallets, risky nodes, VASP destinations and paths through a time-aware graph workbench.
◎
Evidence breakdown
See deterministic matches, model probabilities, path quality, sanctions flags and the final confidence tier.
§
Statutory notice
Pre-populated BNSS Section 94 requisition for the VASP nodal officer and associated account information.
⌁
Sealed archive
BSA Section 63 certificate, case dossier and SHA-256 seal establish an auditable electronic chain of custody.
12 — Implementation stack
Built as a practical, inspectable forensics system.
FRONTENDReact 18 · Vite · Cytoscape.js
BACKENDPython · FastAPI · SQLAlchemy
GRAPHNeo4j · NetworkX · Cypher
ML / AIPyTorch Geometric · TH-GNN · GCN
DATAPostgreSQL / SQLite · JSON cluster data
INTELLIGENCEOFAC · GoPlus · VASP + FIU registries
DOCUMENTSReportLab · SHA-256 evidence sealing
DEPLOYMENTDocker Compose · Async services · fallback sources
Current limitations
- Live coverage depends on explorer keys, rate limits and upstream schemas.
- VASP clusters change as deposit infrastructure rotates.
- Bridges, mixers, privacy assets and off-chain transfers increase uncertainty.
- Seed records and simulated notice dispatch are demonstration behaviour, not production evidence.
Recommended next steps
- Benchmark recall and false positives on labelled multi-chain cases.
- Version every entity label and intelligence feed with provenance.
- Add reproducible evidence export and officer-signature controls.
- Calibrate confidence separately by chain and publish evaluation results.
13 — Research sources
Evidence behind the context.
External figures and cases link to public research or official law-enforcement material. Architecture and flow descriptions come from this repository’s implementation and project documentation.
02
Crypto scam revenue and typologiesKnown 2024 on-chain scam receipts and emerging scam types.
Chainalysis ↗04
North Korea Responsible for $1.5B Bybit HackThousands of addresses across multiple blockchains.
FBI ↗07
Transnational organized crime and cyber fraudMulti-hop laundering through wallets, exchanges and stablecoins.
UNODC ↗