🤖 machine learning

Fraud Detection in Cryptocurrency Markets with Spatio-Temporal Graph Neural Networks

This paper proposes a spatio-temporal Graph Neural Network architecture that detects coordinated cryptocurrency market manipulation, such as pump-and-dump schemes, by modeling the relational connectivity and temporal patterns between assets rather than treating them as independent entities.

Original authors: Lidia Losavio, Luca Persia, Madan Sathe, Dimosthenis Pasadakis

Published 2026-04-28

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Lidia Losavio, Luca Persia, Madan Sathe, Dimosthenis Pasadakis

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The "Secret Handshake" Detector: Spotting Crypto Scams

Imagine you are a security guard at a massive, crowded music festival. Thousands of people are moving around, buying snacks, and dancing. Most people are just there for the music, but a group of professional pickpockets is also hiding in the crowd.

How do you catch them?

If you only look at one person at a time, it’s nearly impossible. A pickpocket looks like just another festival-goer. But if you look closer, you might notice something: whenever one person moves toward a target, three other people suddenly move to block the view or create a distraction. They aren't acting alone; they are moving in a coordinated "dance."

This paper is about building an AI "security guard" that doesn't just watch individuals, but watches the "dance" between different cryptocurrencies to catch scammers.

The Problem: The Lone Wolf Illusion

In the world of cryptocurrency, scammers often perform something called a "Pump and Dump." They pick a small, obscure coin, trick a bunch of people into buying it (the "Pump"), and then sell everything at once, leaving everyone else with worthless digital coins (the "Dump").

Most current AI tools try to catch this by looking at a single coin’s "vital signs"—like its price or how much people are trading. But scammers are smart. They don't just manipulate one coin; they often coordinate movements across several related coins to make the activity look more "natural" or to hide their tracks.

If you only look at one coin at a time, you’re missing the big picture. You’re looking at the individual dancers instead of the choreographed routine.

The Solution: The Spatio-Temporal Graph Neural Network (ST-GNN)

The researchers created a high-tech way to see these connections using something called a Spatio-Temporal Graph Neural Network. Let’s break that scary name down:

The "Graph" (The Social Map): Instead of seeing coins as a list, the AI sees them as a web of connections. If Coin A and Coin B always seem to move in sync, the AI draws a line between them. It creates a "map" of how the market is connected.
"Spatial" (The Neighborhood): This part of the AI looks at the map. It asks: "Is this coin acting weird in a way that its 'neighbors' are also acting weird?" It looks for patterns in the neighborhood.
"Temporal" (The Timeline): This part looks at time. It doesn't just look at a snapshot; it watches the movie. It asks: "Did this sudden spike in activity happen in a way that looks like a coordinated attack over the last few hours?"

The Three Ways to "Draw the Map"

The researchers tested three different ways to figure out which coins are "friends" (connected):

The "Old Friends" Method (Static): It looks at the history of the market and says, "These two coins have always moved together, so I'll assume they are connected."
The "Panic Mode" Method (Dynamic): It says, "I'll only look for connections when things start getting crazy. If a bunch of coins start moving together during a spike, I'll draw lines between them right then."
The "Intuition" Method (Self-Adaptive): This is the smartest one. The AI isn't told how to draw the map; it learns how to draw it. It tries different connections and sees which ones help it catch the most scammers, eventually developing its own "gut feeling" for how the coins are linked.

The Result: A Better Guard

The researchers tested their AI on three years of real-world crypto data. They compared it to standard "old school" math methods (like Random Forests and XGBoost) that only look at individual coins.

The winner? The "Intuition" method (Self-Adaptive).

By learning the secret connections between coins, the AI was much better at spotting the "coordinated dance" of a scam. While the old methods were often fooled by the noise of the market, the new AI could see the signal through the chaos.

The Bottom Line

In the wild west of crypto, scammers don't work alone—they work in teams. This paper proves that to catch a team, you can't just watch the individuals; you have to watch the connections between them. By using "Graph" technology, we can turn a chaotic crowd into a visible map of suspicious behavior.

Technical Summary: Fraud Detection in Cryptocurrency Markets with Spatio-Temporal Graph Neural Networks

1. Problem Statement

The paper addresses the challenge of detecting market manipulation, specifically "pump-and-dump" (P&D) schemes, in cryptocurrency markets. While traditional machine learning approaches treat each financial asset (token) as an independent entity, the authors argue that market manipulation is inherently coordinated and relational. Manipulators often target multiple related assets simultaneously, creating patterns of co-movement in price and volume.

A significant technical hurdle identified is the data limitation: most real-world datasets provide only aggregated market data (OHLCV: Open, High, Low, Close, Volume) at the token level, rather than transaction-level data (sender-receiver graphs). Consequently, the relational structure (the "edges" between tokens) is latent and must be inferred from time-series observations.

2. Methodology

The authors propose a framework that uses a Spatio-Temporal Graph Neural Network (ST-GNN) to model these latent relationships. The methodology is divided into three core components:

A. Graph Inference Strategies (Constructing the "Edges")
Since the graph is not explicitly provided, the authors propose three ways to build the adjacency matrix ( $A$ ):

Static Correlation Graph (G1): Uses a single Pearson correlation matrix calculated from a scalar feature (e.g., volume) over the entire training period. It is time-invariant.
Event-Driven Dynamic Correlation Graph (G2): A piecewise-constant approach that updates the graph structure around known fraud events in the training set. It captures shifts in correlation that occur during manipulation episodes.
Self-Adaptive Adjacency (G3): A deep learning approach where two learnable node embedding dictionaries ( $E_1, E_2$ ) are optimized via backpropagation. The model "learns" the optimal connectivity directly from the data to minimize classification error.

B. ST-GNN Architecture (The Predictor)
The unified architecture processes data in two stages:

Spatial Aggregation: At each timestamp, a Transformer-style Graph Attention layer performs message passing across the inferred graph to capture how one token's movement relates to its neighbors.
Temporal Encoding: The resulting spatial embeddings are fed into a Temporal Transformer Encoder over a lookback window ( $W$ ). This captures how the token's state evolves over time, allowing the model to recognize the "signature" of a pump (e.g., sudden spikes in volume).

C. Experimental Setup
The model was trained on a real-world dataset (2017–2021) containing ~1.9 million observations across 84 tokens. The dataset is highly imbalanced, with fraudulent events representing only ~0.016% of the data, reflecting a realistic surveillance environment.

3. Key Contributions

Latent Graph Construction: Developed methods to transform aggregated, non-graphical time-series data into meaningful spatio-temporal graphs.
Unified ST-GNN Framework: Combined spatial attention-based GNNs with temporal Transformers to capture both inter-token coordination and intra-token temporal signatures.
Realistic Evaluation Protocol: Unlike previous studies that use "local windows" (which can lead to selection bias), this work uses a global historical window, making the detection task significantly harder and more representative of real-world monitoring.

4. Results

The proposed models were compared against standard decision-tree baselines (Random Forest and XGBoost).

Superiority of Graph Models: All graph-based variants outperformed the tree-based baselines in terms of F1-score and Precision-Recall efficiency.
Best Performer: The Self-Adaptive Graph (G3) achieved the highest overall accuracy (F1 $\approx$ 0.62), outperforming even the best correlation-based methods.
Token-Specific Success: For highly manipulated tokens (those with $\ge 5$ events), the self-adaptive model achieved exceptionally high F1-scores (up to 0.93), demonstrating its ability to master the specific relational patterns of frequent targets.

5. Significance

This research demonstrates that relational context is a critical signal for fraud detection. By proving that connectivity can be learned from simple aggregated data (like volume and price), the authors provide a scalable solution for regulators and exchanges to detect coordinated market manipulation without needing access to private, transaction-level ledger data. This moves the field from simple anomaly detection toward coordinated pattern recognition.