Shedding Light on Shadows: Automatically Tracing Illicit Money Flows on EVM-Compatible Blockchains

The pseudo-anonymity and rapidly expanding ecosystem of Decentralized Finance (DeFi) have brought about significant liquidity on EVM-compatible blockchains, making them lucrative targets for cybercriminals. In the modern financial landscape, the need for an automated, high-speed, and effective illicit money tracing system is more urgent than ever to support regulators, on-chain service providers and security practitioners in their efforts to combat the frequent and large-scale occurrences of cyber financial crimes. In this paper, we propose MFTracer, an automated system for tracing illicit money flows on EVM-compatible blockchains. Against the backdrop of a domain where tracing remains labor-intensive and expert-driven, MFTracer is developed in response to two pressing real-world demands: operational efficiency and forensic effectiveness. In response to the sophisticated fund transfer mechanisms enabled by the EVM environment, we introduce a novel fine-grained technique that enables protocol-agnostic transaction-level fund flow analysis. We further propose MFA, a lightweight and purpose-built graph abstraction with a tailored storage backend, to support efficient data retrieval. We also present a simulation algorithm for downstream illicit flow discovery. We implemented MFTracer. Its infrastructure for data retrieval achieves 3.7× to 9.4× higher storage efficiency while being 14.1× to 300× faster than the leading graph database systems. Furthermore, applied to real-world cybercrime incidents, MFTracer achieved 94.09% coverage of illicit money flows. It also newly reported 686 blockchain addresses and 4183 related transactions involved in money laundering that were previously undiscovered. MFTracer was able to reconstruct complete fund flow trajectories and provide strong evidence to investigators for 120.9 million in stolen assets.