Drift-Aware Incremental Clustering for Cryptocurrency Rug-Pull Detection: An Empirical Comparison Against Periodic-Retrain Baselines on Real Ethereum Data

Technical Summary: Drift-Aware Incremental Clustering for Cryptocurrency Rug-Pull Detection

Problem Statement
Cryptocurrency "rug pulls," where developers abandon projects and withdraw liquidity after attracting investment, represent a persistent and costly form of Decentralized Finance (DeFi) fraud. While machine learning approaches for detection have advanced from feature-engineered supervised classifiers to temporal graph neural networks, they typically rely on a periodic retraining paradigm. In this paradigm, models are trained on labeled data and deployed until a scheduled retrain, lacking an explicit, continuously operating mechanism to detect when the underlying decision boundary has drifted between cycles. This mirrors a well-documented failure mode in malware threat intelligence, where adversaries adapt tactics faster than periodic updates can accommodate. This paper investigates whether concept-drift-aware incremental clustering, a technique established in malware detection, can be effectively transferred to the cryptocurrency rug-pull domain to provide stability or accuracy advantages over standard periodic retraining.

Methodology
The study utilizes a temporally hygienic subset of the TM-RugPull dataset, comprising 629 chronologically ordered Ethereum token projects (327 scams, 306 normal). The feature set consists of four log-transformed on-chain behavioral metrics: transaction count, token concentration ratio per holder, total variance, and the variance of holders with more than 1% of tokens.

Two distinct detection paradigms were implemented and compared:

1. Drift-Aware Incremental Clustering: Adapted directly from malware variant detection literature, this unsupervised engine seeds two initial "archetype" clusters (benign and malicious) from a warm-start sample. It assigns subsequent unlabeled projects to the nearest centroid if within a distance threshold (assign_radius), updating centroids incrementally. Projects falling outside this threshold accumulate in pending groups; once a minimum group size (min_new_cluster_size) is reached, a new cluster is formed and typed based on proximity to existing centroids. This allows for continuous updates without waiting for scheduled retraining.
2. Periodic-Retrain Baseline: A Random Forest classifier, representing standard feature-engineered supervised approaches, was retrained periodically as new labeled data became available, subject to a 90-day label-reporting lag to model real-world confirmation delays.

Evaluation Protocol and Rigor
A critical aspect of the methodology was the strict, chronological, "no-lookahead" evaluation protocol designed to prevent hyperparameter tuning leakage. The data was split into a warm-start period, a validation period (exclusively for hyperparameter selection via grid search), and a held-out test period. The study explicitly discarded an initial evaluation that selected hyperparameters against the final test data, as it produced inflated results favoring the clustering approach. To ensure robustness, the corrected protocol was applied across five independent chronological split points (warm-start fractions ranging from 0.15 to 0.35).

Key Results
Contrary to the hypothesis that drift-aware clustering would outperform periodic retraining in an evolving threat landscape, the empirical results on real Ethereum data indicate the opposite for this specific feature set:

• Accuracy: The periodic-retrain baseline achieved a marginally higher mean F1-score (0.891, std 0.008) compared to the drift-aware clustering approach (0.873, std 0.014) across the five splits.
• Stability: The baseline was substantially more stable, exhibiting far lower variance in precision (std 0.015) compared to the clustering method (std 0.064). The clustering approach's precision varied significantly across time periods (ranging from 0.757 to 0.937).
• Trade-offs: The clustering approach demonstrated a distinct advantage in reducing the false-positive rate (lower FPR) in several splits, but this came at the cost of reduced and less stable recall.
• Synthetic Validation: A preliminary synthetic pilot confirmed that the clustering mechanism could maintain perfect recall as malicious behaviors evolved to mimic benign ones, whereas the periodic baseline's recall collapsed. However, this synthetic behavior did not translate to superior performance on the real-world dataset under the corrected protocol.

Significance and Claims
The paper positions its contribution not as a claim of superior classification accuracy (noting that state-of-the-art tools like TokenScout and CRPWarner already achieve strong results), but as a controlled empirical test of a specific methodological transfer: from malware threat intelligence to on-chain fraud detection.

The authors claim a "negative-leaning" but mechanistically grounded result: under the studied feature set and evaluation conditions, the explicit transfer of drift-aware incremental clustering does not provide a measurable stability or accuracy advantage over periodic supervised retraining. The paper argues that the clustering engine's requirement for a minimum number of corroborating points to commit to a new behavioral cluster suppresses false positives but introduces sensitivity to the volume of projects arriving within specific time windows, leading to the observed variance.

The study concludes by motivating three specific directions for future work rather than declaring the approach obsolete:

1. Utilizing richer, graph-structured behavioral features rather than scalar aggregates.
2. Employing more principled hyperparameter optimization (e.g., Bayesian optimization) beyond coarse grid searches.
3. Conducting direct comparisons against temporal graph learning baselines, which remain the central open feasibility question for this research direction.

Ultimately, the paper serves as a cautionary methodological example, illustrating how easily evaluations of novel drift-detection techniques can be biased by tuning leakage and emphasizing the need for leakage-free, multi-split chronological protocols in blockchain threat intelligence research.