Cryptocurrency-related crime continues to expand worldwide. Chainalysis reports that the global value of illicit cryptocurrency transactions has exceeded USD 50 billion, underscoring an urgent need for more advanced digital forensics. Cryptocurrency investigations are particularly difficult when critical evidence resides in volatile memory. Traditional workflows are time-consuming and heavily manual. Cloud-based large language models (LLMs) also pose unacceptable privacy risks in confidential law-enforcement investigations. This paper presents a multi-layer reasoning framework that integrates LangChain with a locally deployed LLM (LLaMA 3.1-8B). The framework acquires volatile evidence via memory dumping, extracts forensic artifacts via keyword and regular-expression search, and performs three-stage reasoning with a Single-Layer Baseline Architecture, a Dual-Layer Supervisor Architecture, and a Tri-Layer RAG-Decider Architecture. We evaluate the framework on 100 purpose-built crypto-wallet forensic questions. The Tri-Layer architecture achieves an average human-evaluation total score of 11.29, which is an 8.9% improvement over the Single-Layer baseline. It also reaches a BERT F1 score of 0.84 in automated metrics, improving by 15.1%. Notably, the local Tri-Layer system performs very close to the commercial cloud model ChatGPT-4o (only a 0.3% gap overall) and surpasses it on the reasoning dimension. These results demonstrate that local LLM deployment can effectively support memory forensics under strict confidentiality and limited compute resources. The proposed approach offers a practical, low-cost, and privacy-preserving tool for digital investigations. It also shows that optimized lightweight local models can approach the analytical quality of cloud-scale models.
