A Full-Node Blockchain Forensic Framework for Cross-Layer Virtual Asset Tracking

Cybercrimes that exploit virtual assets—including laundering, concealment, and illicit financing through the dark web—are increasing rapidly, while existing tracking tools remain limited when offenders leverage multi-layer blockchain architectures and off-chain mechanisms to obscure fund flows. This paper proposes a practical full-node-based blockchain forensic framework for the automated detection and tracking of illicit virtual asset transactions across Layer-1 and Layer-2 environments. The framework operates a full-node network to construct a continuously updated database of all on-chain transactions, from which exchange-controlled internal addresses are identified using six formalized heuristics (H1–H6) expressed as a weighted-sum scoring model. A unified multi-layer transaction graph incorporates Layer-2 events—payment channel closures, rollup batch submissions, and bridge deposits and withdrawals—as contextual edge attributes correlated with Layer-1 settlement. Protocol-specific cross-layer correlation procedures, covering Arbitrum retryable tickets, Optimism cross-domain messages, zkSync Era batch commitments, and third-party bridge relays, were validated on live main-net transactions. Applying the framework to 7511 suspect wallet addresses, 821 (10.93%) were attributed to four Korean exchanges, and real laundering cases involving mixing and swapping—together with integrated real-time alerting and transaction-freeze request functions—demonstrate its direct applicability to law enforcement investigations. In addition, attribution reliability is quantified through the 98.80% labeling consistency observed across repeated independent collections of the same addresses, the standard forensic metrics are formally defined together with publicly released evaluation tooling, and the end-to-end detection latency is bounded analytically by the confirmation properties of the underlying protocols, substantiating the real-time capability of the framework.