TracNetX
Offline, explainable AI that finds the dealer behind mule-account laundering and traces funds from banks to Bitcoin.
Built at AgentX Hackathon 2026
Team OMEGA 404: SHRAVAN KHANAL C, Rithwik Reddy, Kirthik
Built with Python, FastAPI, React, D3.js, Neo4j, Neo4j GDS, PyTorch Geometric, XGBoost, LightGBM, scikit-learn, SHAP, HDBSCAN, FAISS, NetworkX, DuckDB, SQLite, llama.cpp, Docker Compose
About the project
THE PROBLEM
Financial crime doesn't stop at the bank's edge. Illicit money is recruited into mule accounts, layered through shell and hawala intermediaries, aggregated by a "dealer", and increasingly cashed out through Bitcoin. Today's tools flag individual accounts or look at the blockchain alone, so they catch the pawns, miss the coordinator, and see cases only after the damage is done. Most also output a bare risk score with no reasoning, which is useless as evidence.
OUR SOLUTION
TraceNetX is an evidence-grade intelligence platform built on one idea: find the coordinator, not just the criminal. It has two coupled engines covering the full laundering lifecycle:
1. TraceNetX (BEFORE conversion): detects the mule/dealer network inside the fiat banking system before funds reach a crypto off-ramp.
2. TRACE-X (AFTER conversion): fuses network telemetry (IP/ASN/timing) with on-chain Bitcoin data to trace peeling chains, structuring, and mixer/CoinJoin laundering to the cash-out wallet.
HOW IT WORKS
- DETECT: ML ensemble (XGBoost, LightGBM, Random Forest, Isolation Forest, LSTM) with SMOTE balancing and SHAP-guided feature selection.
- INVESTIGATE: Neo4j graph forward traversal (Spider Map) plus reverse-chain tracing from the exit point back to the dealer in 3-4 hops. Community detection, batch-recruitment, convergence, shell, hawala and crypto-gateway pattern detection. Roles are derived from graph structure and behaviour, never from account names, so renaming an account can't evade detection.
- ACT: graduated risk tiers (CRITICAL to CLEAR), per-account SHAP explanations, auto-generated investigation reports, and an Evidence Package export aligned to STR/I4C/FIR workflows.
- TRACE-X intelligence core: entity resolution (common-input Union-Find + GraphSAGE/HDBSCAN + Shadow Entity Resolution), network-identity fusion, anomaly detection, peeling/fan-out/consolidation/mixer classification, and risk propagation, fused by a stacked meta-model into five explainable sub-scores.
WHAT MAKES IT DIFFERENT
- Shadow Entity Resolution: behavioural fingerprinting (fee habits, UTXO selection order, script-type preference, change-output position) via a contrastive encoder + FAISS, linking a brand-new wallet to a known actor with zero shared address or IP.
- Adversarial-aware risk propagation: graph neural diffusion trained against dusting and decoy-dilution attacks, so scores degrade gracefully instead of collapsing under poisoning.
- Offline narrative generation: a quantized local LLM (GGUF/llama.cpp) turns SHAP output and the evidence subgraph into a plain-English investigator brief with zero cloud calls. Fully air-gapped.
- Evidentiary honesty: scores are labelled as severity buckets, not crime probabilities. The UTXO Provenance Lab separates observed from inferred evidence and never fabricates spend links. Datasets are SHA-256 hashed for integrity.
WHAT'S BUILT
Working prototype: FastAPI backend, React + D3 dashboard, Neo4j graph. Verified end-to-end reverse tracing of a multi-hop chain from recruiter through hawala/shell intermediaries to the dealer through the live API. The dashboard includes the Spider Map, ranked alert queue with full dossiers, Replay & Trace, UTXO Provenance Lab, Network Analysis, a live Sandbox simulator, case management, and dataset upload that rebuilds every view. One-command Docker Compose deployment.
IMPACT
Investigators get a single explainable path from a suspicious bank transfer to the wallet where the money comes to rest, with the reasoning auditable at every step. It cuts laundering off at the source, surfaces the kingpin instead of the mule, and fits agencies (cyber cells, FIU, intelligence units) that can't send case data to a cloud vendor. The same architecture extends to exchange/VASP compliance under PMLA and FATF standards.
LIMITATIONS & NEXT STEPS
Benchmarking on the public Elliptic dataset is in progress for external precision/recall numbers. Next: fixing balance conservation in the synthetic generator, hardening the Shadow-ID encoder, and a controlled pilot with a partner cyber cell.