Blockchain forensics inherently involves dynamic and iterative investigations, while many existing approaches primarily model it through static inference pipelines. We propose a paradigm shift towards Agentic Blockchain Forensics (ABF), modeling forensic investigation as a sequential decision-making process. To instantiate this paradigm, we introduce LOCARD, the first agentic framework for blockchain forensics. LOCARD operationalizes this perspective through a Tri-Core Cognitive Architecture that decouples strategic planning, operational execution, and evaluative validation. Unlike generic LLM-based agents, it incorporates a Structured Belief State mechanism to enforce forensic rigor and guide exploration under explicit state constraints. To demonstrate the efficacy of the ABF paradigm, we apply LOCARD to the inherently complex domain of cross-chain transaction tracing. We introduce Thor25, a benchmark dataset comprising over 151k real-world cross-chain forensic records, and evaluate LOCARD on the Group-Transfer Tracing task for dismantling Sybil clusters. Validated against representative laundering sub-flows from the Bybit hack, LOCARD achieves high-fidelity tracing results, providing empirical evidence that modeling blockchain forensics as an autonomous agentic task is both viable and effective. These results establish a concrete foundation for future agentic approaches to large-scale blockchain forensic analysis. Code and dataset are publicly available at https://github.com/xhyumiracle/locard and https://github.com/xhyumiracle/thorchain-crosschain-data.
Systemic risk refers to the overall vulnerability arising from the high degree of interconnectedness and interdependence within the financial system. In the rapidly developing decentralized finance (DeFi) ecosystem, numerous studies have analyzed systemic risk through specific channels such as liquidity pressures, leverage mechanisms, smart contract risks, and historical risk events. However, these studies are mostly event-driven or focused on isolated risk channels, paying limited attention to the structural dimension of systemic risk. Overall, this study provides a unified quantitative framework for ecosystem-level analysis and continuous monitoring of systemic risk in DeFi. From a network-based perspective, this paper proposes the DeFi Correlation Fragility Indicator (CFI), constructed from time-varying correlation networks at the protocol category level. The CFI captures ecosystem-wide structural fragility associated with correlation concentration and increasing synchronicity. Furthermore, we define a Risk Contribution Score (RCS) to quantify the marginal contribution of different protocol types to overall systemic risk. By combining the CFI and RCS, the framework enables both the tracking of time-varying systemic risk and identification of structurally important functional modules in risk accumulation and amplification.
Stablecoins have emerged as a rapidly growing digital payment instrument, raising the question of whether blockchain-based settlement can function as a substitute for incumbent card networks in retail payments. This Systematization of Knowledge (SoK) provides a systematic comparison between stablecoin payment arrangements and card networks by situating both within a unified analytical framework. We first map their respective payment infrastructures, participant roles, and transaction lifecycles, highlighting fundamental differences in how authorization, settlement, and recourse are organized. Building on this mapping, we introduce the CLEAR framework, which evaluates retail payment systems across five dimensions: cost, legality, experience, architecture, and reach. Our analysis shows that stablecoins deliver efficient, continuous, and programmable settlement, often compressing rail-level merchant fees and enabling 24/7 value transfer. However, these advantages are accompanied by an inversion of the traditional pricing and risk-allocation structure. Card networks internalize consumer-side frictions through subsidies, standardized liability rules, and post-transaction recourse, thereby supporting mass-market adoption. Stablecoin arrangements, by contrast, externalize transaction fees, error prevention, and dispute resolution to users, intermediaries, and courts, resulting in weaker consumer protection, higher cognitive burden at the point of interaction, and fragmented acceptance. Accordingly, stablecoins exhibit a conditional comparative advantage in closed-loop environments, cross-border corridors, and high-friction payment contexts, but remain structurally disadvantaged as open-loop retail payment instruments.
A Bitcoin address is a unique identifier for participants in cryptocurrency transactions. The Bitcoin network supports various address formats, including Legacy, Script, Seg-Wit, and Taproot, each distinguished by its specific functionalities and associated transaction fees. Although best privacy practices advise using each address only once for both input and output, our findings indicate that users frequently reuse addresses and may even derive different address types from the same private key. This study investigates the phenomenon of address reuse, provides detailed usage statistics, and introduces KeyLinker– a novel method for grouping addresses by user based on this reuse pattern. Unlike traditional heuristics such as one-time change (OTC) and common spending (CS), KeyLinker is not reliant on heuristics; it offers a dependable solution grounded in the practical impossibility of private key collisions. Through KeyLinker, we identified reliable reuse information for over 260,000 addresses, offering more data than the strict version of OTC and around hundred times less than the information from CS. The method is particularly valuable for AML/KYC compliance in centralized exchanges (CEX) and decentralized exchanges (DEX), providing a deductive and error-free approach to address grouping.
Web-based credit card payments require complete disclosure of all payment card details for transaction authorization. The card’s CVV (Card Verification Value) is the secret code that authorizes card not presented transactions. Currently, all payment card details must be shared among various intermediaries involved in processing the transaction. To mitigate the risks associated with fraudulent transactions, industries have adopted security standards such as the PCI DSS. Credit card data confidentiality rests on all involved stakeholders adhering to best security practices, including data communication encryption, and do not misuse the payment information. However, this security posture does not prevent potential credit card data leaks. We propose an alternative method for conducting remote card payments that does not require disclosing the authorization code while ensuring high interoperability with existing payment networks. Our approach demonstrates how designated verifier Zero-Knowledge Proofs (ZKP) enable minimal disclosure of card details, particularly protecting the confidentiality of authorization codes.
We consider the design of an international CBDC system, where users can transact within or across jurisdictions under central bank issued CBDC units. We present CrossCoin, a pair of an economic design and a blockchain protocol that incentivizes CBDC currency service providers and allocates them CBDC transactions for validation. The CrossCoin economy determines the ideal valuation of transaction validation for service providers under the Cournot regime. The CrossCoin blockchain protocol, an amendment to Streamlet, ensures that the system remains functional even when a minority of the set of enrolled jurisdictional authorities decide to opt out of the economy under exogenous incentives.
NFT is a prominent blockchain technology product that seeps into society after cryptocurrency. Most NFT structures use URL(s) to access external off-chain storage, where the associated asset’s metadata information or the asset itself is stored. This practice is commonly done due to its simplicity, gas cost consideration, or even the possibility of doing on-chain storage. However, questions could be raised for this mainstream NFT structure: What happens if the URL cannot be accessed? Is there any way to verify that an asset is an NFT, suppose the URL is broken? Issues regarding the linkability between an NFT and its asset and the impracticality of NFT verification are rarely highlighted, exposing users to risks such as purchasing an "empty NFT," potentially resulting in growing distrust toward NFT. This paper aims to answer these concerns by proposing a method that preserves and enhances NFTs to their respective asset’s linkability while acting as an NFT verification tool. The method involves registering, mapping, and storing the asset’s hash value with its related NFT information in a resolver smart contract while enabling verification for NFT minted in different blockchain networks.
Management of secret keys for digital signatures is one of the most critical issues in decentralized applications. Since there is no administrator, losing a secret key can result in losing all assets or rights. To address this problem, fuzzy extractors and fuzzy signatures, which generate private keys directly from biometric information, have been considered in addition to conventional biometric authentication. However, these methods using biometric secret keys do not support group signatures. Therefore, it is not applicable to use cases that require consensus building by a specific community (group), such as DAO and DeFi.In this paper, we propose a new scheme for converting existing fuzzy signatures to group signatures using zero-knowledge proofs to address this problem. More precisely, we first define an anonymizable signature that is a generalization of a group signature and then convert a fuzzy signature into an anonymizable signature using an ordinary (classical) zero-knowledge proof. In addition, the signature data size is optimized to a constant size using zk-SNARK. Our implementation experiments show that our schemes achieve practical signature generation and verification times and signature sizes even for a group of up to 100,000 people. This paper’s results can be used to prevent the loss of secret keys and enable flexible DApps use cases.
The recent EU regulation on Markets in Crypto Assets Regulation (MiCA) represents significant progress in establishing a multi-jurisdiction framework for crypto-assets that will enable the greater participation of consumers in the digital assets industry. One type of token recognized by MiCA is the asset-referenced token, where the value-bearing physical asset being referenced by the token is external to the token. We discuss several design considerations for the on-chain and off- chain metadata for the asset-referenced token that represents physical real-world assets. The EU Data Spaces provides an interesting data management framework for the off-chain metadata underpinning the MiCA asset-referenced tokens, including asset definition schemas, asset profiles, digitized asset records, and tokenized asset records. The Web3 decentralized registries for assets-related metadata should be a promising application of the data spaces framework in the EU.
This paper investigates the relationship between Total Value Locked (TVL) and the yield dynamics of liquid restaking tokens (LRTs), a key component of decentralized finance (DeFi). Using data from the Pendle protocol, we systematically explore how liquidity levels relate to fixed yields and implied annual percentage yields (APYs) across contracts. Statistical methods, including quantile analysis, Anderson-Darling, and Kolmogorov-Smirnov tests, reveal statistically significant disparities in yield distributions across TVL quantiles. We further assess economic significance via median differences and effect sizes, illustrating that these disparities are also practically meaningful. Our results demonstrate that lower TVL pools consistently offer higher yields, reflecting elevated risk premiums demanded by investors and the inherent risks associated with lower liquidity. These findings carry practical implications: investors can leverage these systematic yield differentials for arbitrage strategies, while protocol designers can optimize yield structures to enhance competitiveness and support sustainable liquidity. Additional time-series analysis confirms that TVL and yields share a stable long-term relationship, while Granger causality tests do not indicate a unidirectional causal effect. This study is among the first to systematically evaluate the relationship between TVL and yield dynamics in LRTs, offering insights into building more resilient and efficient decentralized systems.
Traditionally, mobile wallets rely on a trusted server that provides them with a current view of the blockchain, and thus, these wallets do not need to validate the header chain or transaction inclusion themselves. If a mobile wallet were to validate a header chain and inclusion of its transactions, it would require significant storage and performance overhead, which is challenging and expensive to ensure on resource-limited devices, such as smartphones. Moreover, such an overhead would be multiplied by the number of cryptocurrencies the user holds.Therefore, we introduce a novel approach, called SNARKlet, to mobile wallet synchronization designed to eliminate trust in a server while providing efficient utilization of resources. Our approach addresses the challenges associated with storage and bandwidth requirements by off-chaining validation of header chains using SNARK-based proofs of chain extension, which are verified by a smart contract. This offers us a means of storing checkpoints in header chains of multiple blockchains.The key feature of our approach is the ability of mobile clients to update their partial local header chains using checkpoints derived from the proof verification results stored in the smart contract. In the evaluation, we created zk-SNARK proofs for the 2, 4, 8, 16, 32, and 64 headers within our trustless off-chain service. For 64-header proofs, the off-chain service producing proofs requires at least 40 GB of RAM, while minimal gas consumption is achieved for 12 proofs bundled in a single transaction. We achieved a 20-fold reduction in storage overhead for a mobile client in contrast to traditional SPV clients. Although we have developed a proof-of-concept for PoW blockchains, the whole approach can be extended in principle to other consensus mechanisms, e.g., PoS.
Efficiency and interoperability are essential for the evolution of secure and scalable e-governance systems. This paper presents a novel framework for interoperable smart contract generation that integrates semantic technologies, and Layer-2 blockchain scaling solutions to enhance interoperability, security, and efficiency in e-governance applications. Using zero-knowledge proofs for privacy-preserving transactions and self-sovereign identity mechanisms for decentralized authentication, the proposed architecture ensures trust and compliance with international standards. Initially applied to e-voting, this framework is adaptable to broader public services, fostering a transparent, cost-effective, and sustainable digital governance ecosystem.
Smart contracts are self-executing and tamper-resistant programs deployed on blockchain networks. Their decentralized and autonomous nature enables various industries to build applications that rely on a single source of truth. However, the pseudonymous nature of blockchain, combined with its immutable design, presents a complex landscape for regulation and accountability. While immutability enhances transparency and traceability, it may also hinder the reversal of malicious or fraudulent transactions, potentially facilitating certain illegal activities. This research compares the contributions of source code and transaction metadata-based features in vulnerability detection. Using the data analysis techniques to correlate vulnerabilities with specified features. The proposed approach achieved nearly 83% accuracy for the source code domain and 55% for the transaction domain. The validation was done by comparing the performance against machine learning models. The results showed that code-based features expose the vulnerabilities of smart contracts more effectively than transaction metadata-based features.
With the advancement of blockchain technology, there is an increasing demand for blockchain interoperability solutions that enable fast and secure data exchange between blockchains developed through diverse processes. However, such solutions are often tailored to specific use cases, underscoring the need for more versatile and standardized protocols. Efficient inter-blockchain communication is critical for the scalability and usability of blockchain ecosystems, enabling seamless integration across diverse networks. In response to this demand, initiatives such as the Cosmos ecosystem have emerged, aiming to achieve enhanced security and faster interoperability. The Cosmos ecosystem utilizes the inter-Blockchain Communication (IBC) protocol to enable seamless interaction between heterogeneous blockchains. This study examines the IBC protocol, the core interoperability technology within the Cosmos ecosystem, and evaluates the transaction transfer times of IBC. The evaluation utilized real blockchain data to measure the distribution of transfer times, using approximately 50,000 transactions originating from Cosmos Hub and Osmosis. The findings reveal the statistical characteristics of IBC token transfer times within the Cosmos ecosystem. Specifically, in the IBC transfers from Cosmos Hub to Osmosis, the IBC transfer time distribution exhibits a peak at approximately 15 s, while the Gumbel or Fréchet distribution yields the lowest Akaike Information Criterion value, depending on the IBC section. Moreover, the results of this study confirm that IBC transfer performance has improved compared to the experiments conducted in June 2022. These findings provide insights for optimizing the performance of IBC and guiding future enhancements to improve cross-chain communication within blockchain networks.
Blockchain networks securely record transactions and enable decentralised transactions using cryptocurrencies. However, the pseudonymity nature of the participants makes the blockchain network a platform for illegal activities, such as money laundering, which poses significant threats to financial security and regulatory compliance. Money laundering activities undermine the integrity of financial systems, foster criminal enterprises, and enable tax evasion. This research explores the impact of timestamp-based (Time step) features in detecting money laundering activities within the Bitcoin network, utilising the Elliptic++ dataset. A correlation-based analysis revealed that the first block appeared in feature was the most strongly correlated with the Time step. Additionally, classification results highlighted XGBoost as the most effective classifier, with the first block appeared in feature identified as the most influential, based on Shapley values from the eXplainable Artificial Intelligence (XAI) technique.
Disinformation is one of the most insidious challenges of our times, and there is an increasing need for sophisticated systems that can deliver truthful content to users. Traditional centralized approach require the trust on a single entity, which often is subject to bias and cannot keep up the pace to the rate at which fake information is produced. Recent proposals aim to leverage the online communities in the process of fact-checking using blockchain-based systems, which can provide the traceability, immutability and transparency of interactions. In this paper, we propose SocialTrustr, a blockchain-based system aimed at ensuring the traceability and validity of content shared within social environments. SocialTrustr is designed to encourage online honesty by rewarding users who publish truthful content and perform honest validations, through a public consensus mechanism based on reputation. We implement our system, release it open source and evaluate it in a real deployment by simulating online user behavior. Additionally, we provide guidelines for future steps aiming to extend the platform to a multi-chain scenario.
Cross-chain bridges are essential for enabling interoperability between diverse blockchain networks. At the same time, these technologies have introduced new avenues for illicit financial activity, such as chain-hopping, a method used to obscure transactional provenance by rapidly transferring assets across multiple chains. This study analyzes cross-chain token flows on the Wormhole bridge, focusing specifically on identifying suspicious token transfer patterns. We propose a methodology inspired by state-of-the-art anomaly detection techniques to identify and examine suspicious transaction patterns. Our findings provide valuable insights into cross-chain analysis and lay the groundwork for developing monitoring systems that can detect and analyze illicit behavior within cross-chain ecosystems.
Previous studies have revealed that Bitcoin’s anonymity is not absolute. Coin mixing protocols have been proposed to address these anonymity issues by breaking or obfuscating the relationship between transaction inputs and outputs, thereby ensuring privacy. Due to their ability to enhance anonymity, these protocols are often associated with illegal money laundering activities, and some mixing services have faced sanctions. This paper examines coin mixing protocols by analyzing the techniques they employ to obscure input-output relationships. Furthermore, it explorers the potential threats to which mixing protocols may be exposed and provides a comprehensive analysis of their vulnerabilities.
We present TenderWallet, a CBDC system that offers a balance of inclusive privacy-preserving access and complete regulatory compliance. Our proposed system provides a CBDC functionality that is responsive to user behaviour, and in case of non-compliance by the user while availing the CBDC service, compensates the indirect monetary loss induced to the nation state, through collateralization. The TenderWallet system is also hybrid, such that it dynamically works as one variant of two well established offline CBDC models, thereby reducing the computational overhead of the service. We detail the behaviour of the TenderWallet system, analyze its deployment characteristics, and argue that it is superior to other potential hybrid CBDC designs. We conclude by showing that TenderWallet is near optimal, while considering compensation to the state and low-compute privacy and transparency of users as the main requirements of a CBDC system.
A multi-party computation (MPC) wallet is being developed as a cryptocurrency wallet that enables the distribution of signing authority to multiple parties. Many vendors are developing MPC wallets based on different cryptographic protocols, which can be readily installed by users, i.e., cryptocurrency exchanges. However, for users, simply introducing the wallet system provided by vendors poses a risk of secret key shares being stolen without their knowledge. We will illustrate methods to secretly steal key shares by exploiting the communication channels with steganography or by modifying the protocol to achieve a fault injection attack. One of the methods is using the error correction capability in QR codes as a covert channel, and another method is embedding hidden bits in the legitimate communication of the underlying MPC protocol. Such attacks can be executed by sophisticated threat actors targeting the vendor’s codebase or through external software dependencies. We will propose measures that user exchanges can implement to address these risks and provide guidance for the secure use of MPC wallets.
