Cryptocurrency theft doesn't end when hackers move stolen funds off-chain; it begins a complex laundering process that now faces a new adversary: artificial intelligence agents trained to follow the money across blockchains. Two emerging approaches, one from blockchain security firm BlockSec and another from academic researchers, are automating what used to require manual detective work, achieving over 95% accuracy in recovering stolen asset trails and identifying high-risk accounts involved in money laundering schemes.

How Do AI Agents Track Stolen Cryptocurrency?

When a cryptocurrency theft occurs, attackers typically move stolen funds rapidly across multiple blockchains and through decentralized finance (DeFi) protocols, which are financial applications built on blockchain networks that operate without traditional intermediaries. The goal is to obscure the origin of the assets and make recovery nearly impossible. Traditional anti-money laundering (AML) methods, which are compliance systems designed to prevent financial crime, rely heavily on manual analysis and heuristic rules, leaving gaps in coverage and requiring significant analyst time.

BlockSec's Trace.ai platform represents a practical implementation of AI-driven investigation. The system works in three steps: first, it collects incident details from users, including wallet addresses, transaction hashes, or descriptions of what happened. Second, the AI agent automatically tracks fund flows across blockchains, identifies receiving entities, and builds a complete picture of where assets went. Third, it generates a forensic report that includes fund flow analysis, entity identification, an incident summary, and recommended actions that can be shared with exchanges, compliance teams, or law enforcement.

A real-world example illustrates the capability: in a sample case involving $250,000 in stolen USDC stablecoin (a cryptocurrency pegged to the US dollar), the system traced funds across Ethereum and identified multiple destination addresses. The report showed that approximately $249,222 of the stolen amount reached centralized exchanges (CEX), which are platforms where users can buy and sell cryptocurrencies, with ChangeNow receiving $125,935, KuCoin receiving $55,128, Binance receiving $47,068, and HitBTC receiving $21,089.

What Makes These AI Systems Different From Traditional Tracing?

The key innovation lies in how AI agents handle the complexity of modern money laundering. Researchers at academic institutions developed RiskTagger, an LLM-guided agent (LLM stands for large language model, the technology behind systems like ChatGPT) that addresses three critical challenges that traditional methods struggle with: extracting key clues from fragmented incident reports, reasoning about multi-step and multi-chain laundering paths without making inconsistent decisions, and producing interpretable results that explain why specific accounts matter to a case.

RiskTagger works by embedding the language model as a decision-making component within a controlled tracing loop. The system first extracts case clues from public incident materials, including seed addresses, affected assets, and timelines. It then recursively expands a risk-labeled fund-flow graph over on-chain evidence, meaning it systematically examines connected transactions and accounts. Finally, it generates evidence-organized reports that analysts can review, including forensic summaries, risk-account records, suspicious transaction behaviors, and evidence-grounded suggestions.

The difference from manual tracing is substantial. Instead of analysts manually reading blockchain explorers and cross-referencing addresses, the AI agent automatically translates transaction evidence, reasons about account risk, and determines which accounts to examine next. The system is constrained by actual on-chain data, preventing the hallucinations or inconsistent decisions that can occur when language models operate without real-world constraints.

How Accurate Are These AI Investigation Tools?

Empirical testing on real-world incidents demonstrates significant accuracy. RiskTagger was evaluated on five actual security incidents with reported losses ranging from $11.6 million to $1.5 billion, totaling approximately $2.39 billion. In the primary test case (the Bybit incident), the system achieved 97.33% address recall, meaning it identified nearly all relevant accounts, and 98.69% expert-reviewed sampled address precision, meaning the accounts it flagged were actually relevant to the case. Across the other four incidents, the system achieved 95.24% to 100% address recall and 91.27% to 100% expert-reviewed address precision.

These accuracy levels matter because false positives in financial investigations can lead to incorrect asset freezes or wrongful accusations, while false negatives allow criminals to escape detection. The high precision rates suggest these systems can reliably identify which accounts are genuinely involved in laundering schemes versus innocent participants in the transaction chain.

What Laundering Patterns Do AI Agents Uncover?

• Short-Cycle Fund Fragmentation: Attackers split stolen funds into smaller amounts across multiple addresses within minutes, making individual transactions harder to detect but creating a traceable pattern when viewed as a whole.
• Long-Range Laundering Paths: Stolen assets move through numerous intermediary addresses and protocols over hours or days, with the AI system able to reconstruct the complete journey even when the path spans multiple blockchains.
• DeFi Service Integration: Criminals route funds through decentralized finance protocols like token swaps and liquidity pools to obscure the origin, but these transactions remain visible on-chain and can be analyzed by AI agents.
• Deterministic Denomination Splitting: Attackers convert stolen assets into specific amounts, such as breaking $250,000 into $10,000 chunks, following patterns that AI systems can recognize and track across multiple addresses.

In the Bybit case specifically, RiskTagger identified a bimodal pulsing topology, meaning the laundering followed two distinct phases: early native-token movement (transfers of the blockchain's primary cryptocurrency) followed by later stablecoin-oriented fragmentation through DeFi services.

How Are Exchanges and Law Enforcement Using These Tools?

The practical application of these AI investigation tools centers on actionable intelligence. BlockSec's Trace.ai generates reports that can be shared directly with centralized exchanges, compliance teams, and law enforcement contacts. When an exchange receives a forensic report identifying specific deposit addresses and transaction hashes associated with stolen funds, it can freeze those accounts and prevent the attacker from converting cryptocurrency into traditional currency, which is the final step in most money laundering schemes.

The reports include specific data points that exchanges and regulators need: deposit addresses where stolen funds arrived, transaction hashes that prove the connection to the original theft, the amount received at each address, and the date and time of each transaction. This level of detail transforms a general report of theft into a concrete action plan.

For law enforcement, the evidence-organized reports produced by systems like RiskTagger provide the foundation for criminal investigations. By identifying high-priority risk accounts and organizing public evidence into verifiable forensic reports, these tools reduce the time required to build a case and increase the likelihood of asset recovery.

What Are the Limitations of AI-Driven Crypto Investigation?

Despite their accuracy, these systems face inherent limitations. They can only trace funds that remain on public blockchains; once cryptocurrency is converted to traditional currency through a regulated exchange or moved to a private wallet, the trail becomes much harder to follow. Additionally, while the AI agents can identify addresses and transaction patterns, they cannot determine the real-world identity behind those addresses without additional information from exchanges or law enforcement databases.

Cross-chain discontinuity presents another challenge. When stolen funds move from one blockchain to another through a bridge protocol (a service that transfers assets between blockchains), the connection can become unclear if the bridge itself is compromised or if the attacker uses multiple bridges in sequence. The AI systems must reconstruct these connections from fragmented evidence, which is possible but requires more complex reasoning.

The systems also depend on the quality of initial incident information. If the seed addresses or affected assets are incorrectly identified, the entire investigation can follow a false trail. This is why the Key-clue Extractor component of RiskTagger is designed to carefully extract information from public incident materials and ask follow-up questions to build an accurate case foundation.

As cryptocurrency theft and money laundering become more sophisticated, AI-powered investigation tools represent a significant shift in how the industry responds to security incidents. By automating the labor-intensive process of tracing stolen assets and identifying high-risk accounts, these systems enable faster recovery efforts and provide law enforcement with the detailed evidence needed to pursue criminal cases. The high accuracy rates achieved in real-world testing suggest that AI agents will become standard tools in the cryptocurrency security and compliance toolkit.