💻 computer science

Behavior–Transaction Relation Dual-Branch Hybrid Graph Neural Network for Joint Modeling of Address Behavior and Transaction Relations in Illicit Bitcoin Address Detection

This paper proposes the Behavior–Transaction Relation Dual-Branch Hybrid Graph Neural Network (BTR-DHGNN), a transductive framework that jointly models address behavior and explicit transaction relations with direction-awareness and adaptive fusion to effectively detect illicit Bitcoin addresses despite label imbalance and UTXO model limitations.

Original authors: Donghui Liu, Wendi Sun, Meiling Gao

Published 2026-09-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Donghui Liu, Wendi Sun, Meiling Gao

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Bitcoin operates on a public ledger, a transparent record of every value transfer that has ever occurred on its network. While the identities behind the digital addresses remain hidden, the flow of funds is entirely visible, creating a unique opportunity for financial investigators. However, this transparency is a double-edged sword. Criminals use complex techniques to obscure their tracks, such as splitting funds across many addresses, combining money from different sources, or moving it through multiple stages to break the link between the origin and the destination. Detecting these illicit activities is difficult because the data is vast, the labels identifying criminals are rare, and the structure of the transactions is intricate. Traditional methods often look at a single address in isolation, counting how many times it sent or received money, but this approach misses the crucial context of how funds actually move through the network.

To solve this, researchers have developed a new system called the Behavior–Transaction Relation Dual-Branch Hybrid Graph Neural Network. This tool treats the Bitcoin network not as a simple list of numbers, but as a complex web where both the habits of an address and its specific connections to other addresses matter. The system works by observing two distinct types of evidence simultaneously. First, it analyzes the "behavior" of an address, looking at its own history: how much money it moves, how often it acts, the fees it pays, and how long it has been active. Second, it examines the "relations," mapping the specific path of funds through the network. Crucially, this system respects the unique way Bitcoin transactions work, distinguishing clearly between money going into a transaction and money coming out, rather than blurring these roles together. By combining these two perspectives, the model can spot patterns that neither view could identify alone.

The researchers tested this system on a massive, fixed dataset of historical Bitcoin transactions containing over 800,000 addresses and more than 200,000 transactions. In this dataset, illicit addresses were a tiny minority, representing less than six percent of the labeled accounts, which made the task of finding them like searching for a few specific grains of sand in a large pile. The new system outperformed all previous methods, including standard statistical tools and other graph-based models. It achieved a success rate where it correctly identified 94 percent of the illicit addresses while keeping false alarms to a minimum. This high level of accuracy is vital because in real-world investigations, too many false alarms overwhelm human analysts, while missing even a few criminals can allow illicit funds to escape.

A key finding of the study is that the system's success relies on the careful balance between looking at an address's own history and looking at its neighbors. The researchers discovered that while the connections to other addresses provide the strongest signal for detection, the address's own behavior is essential for filtering out mistakes. Without the behavioral branch, the system would flag too many innocent addresses as suspicious. Without the relation branch, it would miss the subtle, complex flows of money that characterize criminal activity. The system also learned to handle the rarity of criminal labels by using a special training method that forces it to pay close attention to the few known bad actors rather than ignoring them in favor of the vast number of good ones.

The study further revealed that the way the system looks at the network matters deeply. It found that simply connecting addresses to transactions is not enough; the system must understand the direction of the money. It treats the input of a transaction (where money comes from) and the output (where money goes) as distinct roles. This distinction allows the model to trace the flow of funds more accurately than methods that treat all connections as the same. Additionally, the researchers introduced a technique where the system practices on slightly altered versions of the network during training. This helps the model learn the true structure of the network rather than memorizing accidental or weak connections that might appear by chance.

In the final analysis, this work demonstrates that detecting illicit Bitcoin activity requires a dual approach that respects both the individual habits of an address and its position within the broader flow of funds. The system does not rely on a single trick or a simple rule but integrates multiple layers of evidence to make a decision. It successfully navigates the challenge of extreme imbalance, where criminals are vastly outnumbered by legitimate users, and it does so while maintaining a high degree of precision. The results suggest that for investigators working with historical data, this approach offers a powerful way to narrow down the list of suspicious addresses, making the subsequent manual review and evidence gathering more efficient and effective. The method is designed for analyzing completed transaction histories, providing a robust tool for understanding how funds move through the Bitcoin network and identifying those who seek to hide within it.

Technical Summary: Behavior–Transaction Relation Dual-Branch Hybrid Graph Neural Network for Illicit Bitcoin Address Detection

Problem Statement

The detection of illicit Bitcoin addresses faces three primary challenges:

Insufficient Coordination: Existing methods often fail to effectively coordinate address-level behavioral statistics with specific transaction relations.
UTXO Model Attenuation: Standard graph representations often obscure the boundaries of Unspent Transaction Output (UTXO) events, conflating payer and recipient roles and losing the distinction between transaction inputs and outputs.
Class Imbalance: Verified illicit labels are scarce compared to licit ones, leading to training dominated by the majority class and poor detection of minority illicit actors.

Current feature-based methods compress transaction history into fixed vectors, losing fund-flow topology. Conversely, graph-based methods often use homogeneous graphs or general propagation rules that do not respect the specific input/output semantics of Bitcoin transactions, potentially introducing irrelevant neighbors or false positives.

Methodology: BTR-DHGNN

The authors propose the Behavior–Transaction Relation Dual-Branch Hybrid Graph Neural Network (BTR-DHGNN), a transductive framework designed for a fixed historical Bitcoin transaction graph. The architecture consists of four main stages:

1. Dual-Branch Architecture

Behavior Branch: This branch models the target address's intrinsic patterns. It combines standardized address statistics (55 features) with robust deviations calculated relative to the licit training population. Features are grouped into five semantic categories (Activity, Amounts/Position, Fees, Timing, Counterparties). Each group is encoded by an independent Multi-Layer Perceptron (MLP) and then processed by a Group Transformer using cross-group attention to capture interactions between different behavioral dimensions.
Relation Branch: This branch explicitly models the heterogeneous address-transaction graph while preserving UTXO semantics.
- Node Types: It retains both address and transaction nodes.
- Direction-Aware Propagation: It distinguishes between input roles (address $\to$ transaction) and output roles (transaction $\to$ address). Message passing aggregates neighbor information using Mean, Max, and Standard Deviation statistics.
- Multi-Hop Learning: The encoder stacks two propagation blocks to learn both direct and higher-order fund-flow relations without adding residual connections that might duplicate information from the behavior branch.

2. Structural Regularization and Fusion

Stochastic Relation Views: During training, two stochastic views of the graph are constructed by independently dropping edges (Bernoulli mask). This reduces dependence on incidental local connections. The model enforces consistency between these views and aligns the behavioral representation with the relational representation.
Stability Predictor: A predictor estimates the stability of a node's relational representation based on the agreement between the two stochastic views.
Reliability-Aware Fusion: A gating mechanism adaptively weights the contributions of the behavior and relation branches for each node. This gate uses the interaction representation (concatenation of behavior, relation, their difference, and product) and the predicted stability score. An interaction classification head further fuses these signals to capture non-linear agreements and discrepancies.

3. Loss Function
To address class imbalance, the model employs Class-Balanced Focal Loss (CBFL). This combines effective-number weighting (to handle extreme imbalance without unstable weights) and focal modulation (to down-weight easy examples), ensuring optimization focuses on hard, minority-class cases. Auxiliary supervision is applied to both branches.

Key Contributions

Dual-Branch Framework: A novel architecture that separately models address behavior and direction-aware transaction relations, allowing them to be learned jointly without structural compression.
Direction-Aware Relation Encoder: A mechanism that preserves UTXO event boundaries and explicitly distinguishes input/output roles, combined with stochastic relation views to improve structural robustness.
Adaptive Fusion: A node-level gating mechanism that dynamically balances behavioral and relational evidence based on predicted stability and interaction patterns.
Empirical Validation: Extensive experiments on the Elliptic++ dataset demonstrating superior performance over both feature-based and graph-based baselines.

Results

Evaluated on a fixed 70%/30% transductive split of the Elliptic++ dataset (containing ~822k address nodes and ~202k transaction nodes), BTR-DHGNN achieved:

Illicit-class F1 Score: 0.9402
Average Precision (AP): 0.9829
Precision: 0.9428
Recall: 0.9377

Comparative Performance:

Compared to the best feature-based baseline (Random Forest), BTR-DHGNN improved the F1 score by 11.27%.
Compared to the best conventional feature baseline (XGBoost), it improved AP by 6.88%.
Unlike generic graph models (GCN, GAT, GraphSAGE) which achieved high recall but low precision (leading to high false positive rates), BTR-DHGNN maintained high precision (>0.94) while achieving high recall (>0.93).

Ablation Findings:

Transaction Relations were identified as the stronger individual evidence source, but the Behavior Branch was crucial for reducing false positives and improving ranking.
Direction-aware modeling and semantic grouping were critical; removing them significantly degraded performance.
Propagation Depth: Two propagation blocks provided the optimal trade-off between F1 and AP; deeper propagation improved AP but reduced F1 at the fixed operating point.
Stochastic Views: Moderate edge perturbation (15% drop rate) acted as effective structural regularization.

Significance and Claims

The paper claims that BTR-DHGNN addresses the specific limitations of prior work by:

Decoupling yet Coordinating Evidence: It treats address behavior and transaction topology as distinct but complementary evidence sources, fused adaptively rather than forced into a single representation.
Respecting UTXO Semantics: By retaining transaction nodes and distinguishing input/output roles, the model avoids the "conflation" of payer/recipient roles common in homogeneous graph approaches.
Operational Utility: The model is designed for post-hoc analysis on fixed historical graphs. Its high precision and recall help constrain candidate sets for illicit address screening, supporting manual review, fund-flow expansion, and retrospective tracing in cryptocurrency investigations.

The authors explicitly note that their conclusions are limited to a transductive setting on a fixed historical graph. They do not claim immediate applicability to inductive settings (new, unseen nodes) or temporal extrapolation, identifying these as necessary future work for practical, real-time deployment. The method relies on the availability of a reasonably complete historical transaction graph and verified labels for training.