[Paper Review] GuiltyWalker: Distance to illicit nodes in the Bitcoin network

Catarina Oliveira, João Torres+4 more|arXiv (Cornell University)|Feb 10, 2021

Crime, Illicit Activities, and Governance10 references4 citations

TL;DR

GuiltyWalker proposes a graph-based feature engineering method that uses random walks from seed nodes to compute distances to known illicit Bitcoin transactions, significantly improving supervised machine learning models for anti-money laundering detection. By integrating these structural features with existing ones, the method boosts F1-score by 5pp, especially during black market shutdowns where prior models underperform.

ABSTRACT

Money laundering is a global phenomenon with wide-reaching social and economic consequences. Cryptocurrencies are particularly susceptible due to the lack of control by authorities and their anonymity. Thus, it is important to develop new techniques to detect and prevent illicit cryptocurrency transactions. In our work, we propose new features based on the structure of the graph and past labels to boost the performance of machine learning methods to detect money laundering. Our method, GuiltyWalker, performs random walks on the bitcoin transaction graph and computes features based on the distance to illicit transactions. We combine these new features with features proposed by Weber et al. and observe an improvement of about 5pp regarding illicit classification. Namely, we observe that our proposed features are particularly helpful during a black market shutdown, where the algorithm by Weber et al. was low performing.

Motivation & Objective

• To improve supervised machine learning performance in detecting illicit Bitcoin transactions using structural features from the transaction graph.
• To address the limitations of existing models during periods of high network disruption, such as black market shutdowns.
• To develop a method that leverages past labels and network topology to extract informative features for classification.
• To demonstrate that distance-based features derived from random walks convey unique, non-reduundant information beyond standard transaction features.
• To enhance model robustness and detection of new illicit activity by incorporating graph-based temporal dynamics.

Proposed method

• GuiltyWalker performs random walks on a time-ordered Bitcoin transaction graph, starting from seed nodes and moving only to older (earlier) transactions via incoming edges.
• The random walker stops when it reaches a known illicit node or when no further valid predecessors exist, ensuring finite walks due to temporal ordering.
• For each seed node, multiple random walks are sampled to explore diverse paths to illicit nodes, capturing structural proximity.
• A feature extractor computes aggregated statistics from the walks, such as average steps to first illicit node, total distinct illicit nodes reached, and walk success rate.
• These new features are combined with the original 166 anonymized features from Weber et al. (2019) for training supervised classifiers.
• Feature selection is applied to retain only the most informative GuiltyWalker-derived features, improving model efficiency and performance.

Experimental results

Research questions

• RQ1 Can graph-structural features derived from random walks improve supervised learning performance in detecting illicit Bitcoin transactions?
• RQ2 How does the performance of existing models change during periods of network disruption, such as black market shutdowns?
• RQ3 Do distance-to-illicit-node features provide unique, non-redundant information compared to standard transaction features?
• RQ4 Can GuiltyWalker’s features help detect new illicit transactions that existing models miss?
• RQ5 To what extent do GuiltyWalker features enhance model robustness and generalization across different network states?

Key findings

• GuiltyWalker improves the F1-score of supervised models by approximately 5 percentage points compared to models using only the original 166 features from Weber et al. (2019).
• The performance gain is most pronounced during a black market shutdown, where the baseline model’s performance dropped significantly, but GuiltyWalker-enhanced models remained robust.
• The new features provide unique information not captured by the original features, as evidenced by the fact that some nodes with no path to illicit nodes still had high feature values, indicating structural insight.
• Models using GuiltyWalker features demonstrated higher recall (76.7%) and F1-score (85.47%) than the baseline and prior ensemble methods, despite slightly lower precision.
• The method successfully identified illicit transactions that were missed by the original model, particularly in dynamic or high-disruption network phases.
• Feature selection improved model performance further, confirming that not all GuiltyWalker features are equally informative, and filtering enhances efficiency and accuracy.