Ethereum Money Laundering Detection Pipeline — KNIME + Neo4j + Streamlit

Hello everyone,
Congrats on the new community site — it looks really cool.

I built a blockchain forensics pipeline that traces stolen funds across four real DeFi exploits, detects systematic laundering patterns, and produces an interactive dashboard.

Results: $199M traced, 1,243 Tornado Cash deposits detected, 559 wallets analyzed across 3 hops of fund-flow tracing.

The Cases:

- Beanstalk Farms ($181M, Apr 2022) — direct deposit, 3-hour laundering window

- Nomad Bridge ($190M, Aug 2022) — 191-wallet convergence with zero statistical variance in amounts sent

- Euler Finance ($197M, Mar 2023) — mostly returned funds, with a small partial-laundering trail and a North Korea / Lazarus Group cross-link

- Harmony Bridge ($100M, Jun 2022) — three-layer equal splitting before laundering

How KNIME Is Used:

The workflow is a single configurable component wrapping three stages:

- Initialization — sets database constraints, writes seed wallets, and labels ~50 known entities (exploit contracts, DEX/bridge/mixer infrastructure, exchanges) by category, so all downstream filtering works off `category` instead of hardcoded address lists

- ETL — a recursive loop that extracts wallet transaction history from Etherscan (3 endpoints per wallet, with automatic pagination for high-activity wallets), transforms it, writes it to Neo4j, then reads a "frontier" of newly discovered wallets to feed back into the next loop iteration

- Detection & Export — 8 Cypher-based detectors (Tornado Cash fingerprinting, convergence, splitting, composite risk scoring, etc.) query the finished graph and export results as JSON for a Streamlit dashboard

Everything Is on GitHub

Full .knwf workflow, all Cypher queries, the Streamlit dashboard, a Neo4j database dump of the actual extracted graph, and documentation with screenshots of every workflow stage:

🔗 https://github.com/mehrdadbgh/ethereum-aml-detection

The README walks through each meta node in detail if you want to see the extraction/pagination/labeling logic before opening the workflow itself.

If you like this workflow, I’ll soon build another MVP for NFT wash — so stay tuned.

Br,
Mehrdad