Demystifying Fraudulent Transactions and Illicit Nodes in the Bitcoin Network for Financial Forensics

1 INTRODUCTION

• Financial-forensics models should prioritize recall despite a reasonable precision trade-off and support explainability of transaction and account risk.The stated rationale is that wrongly classifying illicit activity as licit is more costly than the reverse.Source: §1 · p. 1
• The Elliptic dataset labels over 203k transactions but omits address features and interactions, limiting identification of wallets responsible for predicted illicit transactions.A transaction can be associated with several input and output addresses.Source: §1 · p. 1
• Elliptic++ extends the transaction dataset with over 822k labelled wallet addresses, each with 56 features, and over 1.27M temporal interactions across four graph types.The representations include transaction money flow, address interactions, address-transaction flows, and user-entity address clusters.Source: §1 · pp. 1–2
• RF feature refinement raises transaction precision from 97.5% to 98.6% and recall from 71.9% to 72.7%.For actors, precision rises from 91.1% to 92.1% and recall from 78.9% to 80.2%.Source: §1 · p. 2

2 RELATED WORK

• Prior Elliptic-dataset work includes active learning, GuiltyWalker graph features [30], comparative supervised methods, and graph-based anomaly-detection models and.The cited approaches include transaction-graph distance features, a graph neural network, and graph-based LSTM.Source: §2 · p. 2
• Bitcoin account profiling includes a 9,000-address dataset used to classify miners or exchanges, while labelled-data scarcity and imbalance challenge fraud detection, [17], [31] [32].Other cited directions include graph-based methods for identifying transactions and de-anonymizing mixed transactions.Source: §2 · p. 2
• Ethereum account profiling and phishing detection use graph representation learning, but differences between UTXO and account models make direct application to Bitcoin non-straightforward.Cited methods include GCN [18], HGATE, TTAGNN, Trans2Vec, and a LightGBM-based cascade.Source: §2 · p. 2
• The paper presents a labelled Bitcoin transaction-and-address dataset and uses it to demonstrate detection of illicit transactions and actors and address-clustering deanonymization risks.It reports 822,942 addresses, described as the largest public Bitcoin account dataset to the authors’ knowledge.Source: §2 · p. 2

3 THE ELLIPTIC++ DATASET

• Elliptic++ combines 203k Bitcoin transactions with 822k wallet addresses and four graph representations for forensic analysis.The graph types capture transaction money flow, address interactions, address-transaction flow, and address clusters representing users.Source: §3 · p. 2, §3.3 · p. 4

3.1 Transactions Dataset

• The transaction graph contains 203,769 nodes, 234,355 directed payment-flow edges, and 183 features per transaction across 49 time steps.Of its features, 166 are inherited from Elliptic and 17 are added by the Elliptic++ collection pipeline.Source: §3.1 · pp. 2–3

3.2 Actors (Wallet Addresses) Dataset

• The actors dataset contains 822,942 wallet addresses with 56 features each, and labels an address illicit if it has at least one edge to an illicit transaction.Address labels also use a 3.7 ratio threshold for unknown versus licit transaction edges.Source: §3.2 · pp. 3–4
• The dataset records 1,268,260 wallet-address occurrences across time steps, including 2% illicit, 27% licit, and 71% unknown occurrences.Across address classes, 14,266 are illicit and 251,088 are licit; the remainder are unknown.Source: §3.2 · p. 4

3.3.1 Money Flow Transaction Graph.

• The transaction-to-transaction graph represents directed BTC flows and exposes spatial and temporal neighborhoods around transactions.The illustrated four-hop neighborhoods compare selected unknown, illicit, and licit transactions in time step 32.Source: §3.3.1 · p. 4, Figure 3 · p. 5
• Illicit transactions make up 2% of the dataset but appear in every time step, supporting use of earlier sequence data for later forensic analysis.Time steps can produce sparse or dense graphs, changing neighborhoods from shallow and wide to deep and narrow.Source: §3.3.1 · pp. 4–5

3.3.2 Actor Interaction Graph.

• The actor interaction graph connects addresses that interact as inputs and outputs, showing address-level rather than transaction-level relationships.Graph density affects the density of a wallet address's k-hop neighborhood.Source: §3.3.2 · p. 5

3.3.3 Address-Transaction Graph.

• The address-transaction graph uses sender-to-transaction and transaction-to-receiver edges to represent BTC flow and relationships among addresses in a transaction.This heterogeneous graph distinguishes address nodes from transaction nodes and can help evaluate transaction purposes.Source: §3.3.3 · p. 5

4.1 Dataset Preprocessing

• The study uses a 70/30 time-step split, training on steps 1–34 and testing on steps 35–49, and scales selected features to (0, 1).MinMaxScaler is applied to augmented transaction features and all actor features, with scaling described as addressing class imbalance and aiding convergence.Source: §4.1 · p. 6, Figure 7 · p. 6

4.2 Machine Learning Models

• The evaluated classifiers are Random Forest, MLP, LSTM, XGB, and Logistic Regression as the baseline.The paper notes prior studies indicating ensemble methods perform better than graph neural networks.Source: §4.2 · pp. 6–7

4.3 Fraud Detection Evaluation Metrics

• Evaluation uses precision, recall, F1, Micro-F1, and sometimes MCC, alongside easy, hard, and average illicit-transaction case studies.MCC is used in some close classifier comparisons because of its suitability for unbalanced datasets.Source: §4.3 · p. 7

5.1 Statistical Analysis of the Dataset

• Feature trends distinguished illicit from licit cases for some features, such as transaction Local Feature 53, but not others, such as Local Feature 15.Source: §5.1 · p. 7
• The dataset analysis tracks 15 illicit actors active in at least five time steps; Actor 1 spans 15 steps, while Actor 15 spans six.Another 14,007 illicit actors occur in only one time step.Source: §5.1 · p. 7, Figure 9 · p. 7, Figure 10 · p. 7
• Address clustering produced 146,783 user entities; 98.72% controlled at most 10 addresses, while 0.02% controlled at least 1,000.Source: §5.1 · p. 7, Table 6 · p. 8

5.2 Model Evaluation and Analysis

• RF was best on both tasks, with transaction precision and recall of 97.5% and 71.9%, and actor precision and recall of 91.1% and 78.9%.Source: §5.2 · p. 8, Table 7 · p. 8, Table 8 · p. 8
• Actor ensembles raised precision to 95.9% and 93.3% but lowered recall to 53.0% and 57.2%, versus RF’s 91.1% precision and 78.9% recall.Source: §5.2 · p. 8, Table 8 · p. 8

5.3 EASY, HARD, and AVERAGE cases Analysis

• Four classifiers jointly handled 71% of AVERAGE transaction cases, while RF misclassified under 1%, motivating RF feature refinement.Source: §5.3 · p. 8, Table 9 · p. 9

5.4 Model Optimization by Feature Refinement

• The 17 augmented transaction features contributed 12% of transaction feature importance, while 35% of actor features accounted for 80%, led by total address interaction.Source: §5.4 · p. 9, Figure 11 · p. 9
• Feature refinement improved average transaction precision, recall, and F1 by 0.92%, 1.17%, and 0.89%, and actor scores by 1.07%, 3.1%, and 1.13%.Source: §5.4 · p. 9

6 CONCLUDING REMARKS

• Elliptic++ combines over 203,000 transactions and 822,000 addresses with four graph representations for anomaly detection of illicit transactions and accounts.Source: §6 · p. 10
• The paper evaluates diverse machine-learning approaches across transaction, actor, and user de-anonymization tasks, with graph visualizations supporting explainability.Source: §6 · p. 10
• Selected-feature training improved RF transaction precision and recall by 0.92% and 1.17%, and actor precision and recall by 1.07% and 3.1%.Source: §6 · p. 10
• The Elliptic++ dataset and tutorials are publicly available for researchers developing Bitcoin financial-forensics and fraud-detection models.Source: §6 · p. 10

A.1 Dataset Collection

• The collection uses 203,000 labeled Elliptic transactions as crawling seeds to gather accounts involved in the transactions.Source: §A.1 · p. 12
• A blockchain parser augments transaction features, after which an extractor gathers features for the addresses involved.Source: §A.1 · p. 12
• Structured transaction and account data, including features needed for four graph representations, are organized for anomaly-detection mining and visualization.Source: §A.1 · p. 12
• Collecting, cleaning, parsing, and labeling the data required substantial computing and storage resources and took several weeks on Georgia Tech’s PACE clusters.Source: §A.1 · p. 12

• Precision is the fraction of positive points correctly classified.Source: §A.2 · p. 12
• Recall is the fraction of actual positive points correctly classified.Source: §A.2 · p. 12
• F1 Score is the harmonic mean of precision and recall.Source: §A.2 · p. 12
• Micro-Avg F1 Score uses total TP, FP, and FN counts rather than computing them individually for each class.Source: §A.2 · p. 13
• Matthews Correlation Coefficient measures binary-classification quality by accounting for differences between predicted and actual values.It ranges from −1 for perfect misclassification to +1 for perfect classification.Source: §A.2 · p. 13

• Time step 14 produces sparser graphs than time step 32, whose edge density is reflected by the grey area.Figures 14–16 show transaction, wallet-address, and combined transaction/address distributions for the Money Flow Transaction, Actor Interaction, and Address-Transaction graphs.Source: §A.3 · p. 13

• The multiple input addresses heuristic attributes all input addresses of a transaction to one user, assuming that user controls the private keys needed to sign the transaction.Source: §A.4 · p. 13
• The clustering procedure groups transactions with at least one shared input address, highlights each user’s transactions, then creates user-graph edges where paths existed between transaction groups.Source: Figure 17 · p. 14
• Figure 18 illustrates the heuristic by grouping addr1–addr4 as U1 and addr5–addr6 as U2.Source: §A.4 · p. 13, Figure 18 · p. 14

A.5 Statistical Analysis of the Dataset

• Among illicit actors present in only one time step, counts rise from 8 at time step 6 to 74 at step 14 and 759 at step 32.Figure 19 plots the distribution for 14,007 such actors, with a logarithmic y-axis.Source: §A.5 · p. 14, Figure 19 · p. 15
• Green-highlighted feature trends distinguish illicit from licit classes, whereas red-highlighted trends show no characteristic class pattern.Figure 20 covers transaction local and aggregate features and actor transaction and time features.Source: §A.5 · p. 14, Figure 20 · p. 15

A.6 Data Distribution

• Tables 12 and 13 report transaction and wallet-address class counts by time step, with the first two tables for training and the third for testing.Source: §A.6 · p. 14, Table 12 · p. 16, Table 13 · p. 16