AMLGuard's semantic net catches 98.4% of DeFi laundering addresses

In the year of our algorithm, on-chain analytics tools suffer from a peculiar form of blindness: they track token transfers, not intent. A swap, a flash loan, and a liquidity deposit all look like raw opcode sequences to Chainalysis or Elliptic. That gap is exactly where launderers hide. AMLGuard, a new system from a team of researchers, closes it by combining retrieval-augmented LLM reasoning with static rule-based analysis to infer the semantics of complex DeFi transactions [^claim_2580]. The result is a tracking system that catches 98.4% of laundering addresses on single-chain datasets and 95.8% cross-chain [^claim_2584][^claim_2585].

Existing anti-money laundering methods for DeFi rely heavily on low-level token transfers or protocol-agnostic money flow analysis, failing to capture high-level transaction intent [^claim_2579]. AMLGuard solves this by first parsing transaction parameters — especially for cross-chain transactions where laundering intent is not explicitly exposed — and performing argument parsing to recover cross-chain semantics [^claim_2581]. Each transaction is then abstracted into a DeFi Semantic Unit (DSU) based on inferred semantics [^claim_2582]. This abstraction compresses complex multi-hop laundering chains into graph primitives, making fund-flow topology reconstruction computationally cheap.

The system was evaluated on 82 real-world laundering cases involving illicit assets worth over $1 billion [^claim_2583]. On single-chain datasets, AMLGuard achieves destination precision of 94.4%, address recall of 98.4%, and destination recall of 94.1% [^claim_2584]. On cross-chain datasets, destination precision is 87.6%, address recall 95.8%, and destination recall 93.8% [^claim_2585]. The cross-chain precision drop of roughly 7 points quantifies the remaining gap — one that cross-chain messaging protocols like LayerZero or Chainlink CCIP could close by standardizing argument schemas.

For DeFi security, the implications are direct. A compliance-focused blockchain or regulated DeFi protocol can use AMLGuard’s 98.4% address recall as a baseline for Travel Rule compliance — missing fewer than 2% of laundering addresses. Bridge operators and security auditors (e.g., Forta, OpenZeppelin Defender) can adopt DSUs as a standard intermediate representation for threat intelligence feeds, compressing complex laundering flows into graph primitives that are computationally cheaper to analyze at scale. The 82-case benchmark also gives AML/analytics startups like TRM Labs and Merkle Science a ground-truth dataset to validate their own models.

The hybrid LLM+rule approach directly addresses a blind spot in existing tools, and the DSU abstraction provides a compact representation for cross-chain fund-flow reconstruction. Watch for adoption by on-chain compliance platforms and bridge security monitors — and for cross-chain messaging protocols to close the precision gap by standardizing argument schemas.