# LOCARD: An Agentic Framework for Blockchain Forensics

arXiv: https://arxiv.org/abs/2604.04211 · HTML: https://mlsanity.com/paper/2604.04211/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 12 of its 26 references that are in the map.
- First posted on arXiv 5 Apr 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 12 of 12)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [GPT-4o System Card](https://mlsanity.com/paper/2410.21276/) (2024)
- [A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions](https://mlsanity.com/paper/2311.05232/) (2023)
- [The Landscape of Agentic Reinforcement Learning for LLMs: A Survey](https://mlsanity.com/paper/2509.02547/) (2025)
- [Blockchain Large Language Models](https://mlsanity.com/paper/2304.12749/) (2023)
- [TRacer: Scalable Graph-based Transaction Tracing for Account-based Blockchain Trading Systems](https://mlsanity.com/paper/2201.05757/) (2022)
- [GraphSense: A General-Purpose Cryptoasset Analytics Platform](https://mlsanity.com/paper/2102.13613/) (2021)
- [CONNECTOR: Enhancing the Traceability of Decentralized Bridge Applications via Automatic Cross-chain Transaction Association](https://mlsanity.com/paper/2409.04937/) (2024)
- [XChainDataGen: A Cross-Chain Dataset Generation Framework](https://mlsanity.com/paper/2503.13637/) (2025)
- [Track and Trace: Automatically Uncovering Cross-chain Transactions in the Multi-blockchain Ecosystems](https://mlsanity.com/paper/2504.01822/) (2025)
- [A Survey of Transaction Tracing Techniques for Blockchain Systems](https://mlsanity.com/paper/2510.09624/) (2025)

## Abstract (arXiv)

Blockchain forensics inherently involves dynamic and iterative investigations, while many existing approaches primarily model it through static inference pipelines. We propose a paradigm shift towards Agentic Blockchain Forensics (ABF), modeling forensic investigation as a sequential decision-making process. To instantiate this paradigm, we introduce LOCARD, the first agentic framework for blockchain forensics. LOCARD operationalizes this perspective through a Tri-Core Cognitive Architecture that decouples strategic planning, operational execution, and evaluative validation. Unlike generic LLM-based agents, it incorporates a Structured Belief State mechanism to enforce forensic rigor and guide exploration under explicit state constraints. To demonstrate the efficacy of the ABF paradigm, we apply LOCARD to the inherently complex domain of cross-chain transaction tracing. We introduce Thor25, a benchmark dataset comprising over 151k real-world cross-chain forensic records, and evaluate LOCARD on the Group-Transfer Tracing task for dismantling Sybil clusters. Validated against representative laundering sub-flows from the Bybit hack, LOCARD achieves high-fidelity tracing results, providing empirical evidence that modeling blockchain forensics as an autonomous agentic task is both viable and effective. These results establish a concrete foundation for future agentic approaches to large-scale blockchain forensic analysis. Code and dataset are publicly available at https://github.com/xhyumiracle/locard and https://github.com/xhyumiracle/thorchain-crosschain-data.