FlowShield Research Combines Fund-Flow Tracking and LLMs for Crypto AML Detection

A new research preprint proposes a cryptocurrency anti-money laundering framework that combines transaction semantics, fund-flow reconstruction, graph learning and large language models to detect laundering activity and generate investigator-facing reports.

The paper, FlowShield: Cryptocurrency Anti-Money Laundering with Transaction Semantics Parsing and Fund Flow Tracking, was posted on 18 August 2026 by Qishuang Fu, Andreas Deppeler, Joseph K. Liu, Yixin Liu, Shirui Pan, Qin Wang, Weiqing Wang and Tsz Hon Yuen. The work is currently a preprint and its reported results should therefore be treated as research findings rather than independently validated production performance.

Tracking how illicit value moves

The researchers argue that many existing crypto AML approaches focus heavily on address-level or graph-topology signals, while modern laundering activity can rapidly fragment funds through direct transfers, token swaps, indirect transfers and cross-chain movements. FlowShield attempts to preserve those behavioural differences instead of treating every transfer as structurally equivalent.

The framework first parses transactions into four semantic types: direct transfers, token swaps, indirect transfers and cross-chain transfers. It then constructs local fund-flow subgraphs from three perspectives: upstream activity to identify potential funding sources, downstream activity to capture subsequent redistribution, and parallel activity to identify similar-value movements occurring within a close time window.

Those behavioural descriptions are encoded with a large language model, while graph structure is processed with a graph convolutional network. FlowShield then fuses the textual and structural representations to classify transactions and organise detected multi-hop flows into investigator-facing suspicious activity reports containing a flow diagram, summary and red flags.

BybitML adds a multi-chain laundering dataset

A second contribution is BybitML, which the authors describe as the first publicly available multi-chain Crypto AML dataset derived from a major real-world security incident. The dataset includes transaction-level laundering labels and semantic annotations intended to capture fund movements across different transaction behaviours and blockchains. The researchers have also made the dataset and FlowShield implementation publicly available for further testing.

FlowShield was evaluated on BybitML and two existing public laundering datasets against 13 representative baseline methods. The authors report an average F1 score of 98.0% and say the system also produced readable summaries of suspicious multi-hop fund flows. These figures remain experimental results from the authors’ evaluation and should not be interpreted as a guaranteed detection rate in live AML environments.

For compliance and blockchain-analytics teams, the research is notable less for a single performance figure than for the attempt to connect detection with explainable fund-flow reconstruction and investigator reporting. If such approaches prove robust on broader real-world datasets, they could help narrow the gap between an automated crypto alert and the evidence an analyst actually needs to investigate and document the case.