Beyond Volume: Decoding Bitcoin Identities through Transaction Moments

TL;DR

Researchers from National Taiwan University have elevated Bitcoin address classification by moving beyond simple transaction counts. By treating transaction history as a distribution and extracting high-order statistical moments (like skewness and kurtosis), they achieved an 87% F1-score in identifying service types—proving that when and how you transact is as revealing as how much you send.

Background & Motivation: The Pseudo-Anonymity Gap

While Bitcoin is often labeled "anonymous," it is technically pseudo-anonymous. Every transaction is public, yet linking an address to a real-world entity remains a game of cat and mouse. Governments and exchanges need to identify high-risk addresses (e.g., mixers, illegal markets) to combat money laundering.

The authors observed that previous methods were either too simple (basic frequency) or computationally expensive (complex graph traversal). Their insight? Every category of Bitcoin user—be it a miner, a gambler, or an exchange—has a unique "temporal heartbeat." By summarizing this history into statistical "moments," they could capture these signatures efficiently.

Methodology: The Three Pillars of Feature Engineering

The core contribution lies in the expansion of the feature space from 26 dimensions to 64, categorized into three types:

1. Basic Statistics: Transaction frequency and ratio of received/spent coins.
2. Extra Statistics: Lifetime of the address, USD-equivalent value at the time of transaction, and balance volatility (${\sigma }_{balance}$).
3. Transaction Moments: This is the "secret sauce." The authors treat block heights of transactions as a discrete random variable and calculate:
   • 1st Moment (Mean): Central location in time.
   • 2nd Moment (Variance): Spread of activity.
   • 3rd Moment (Skewness): Symmetry of activity (e.g., front-loaded vs. back-loaded).
   • 4th Moment (Kurtosis): "Peakedness" (sudden bursts vs. steady activity).

Table: The detailed feature set across Basic, Extra, and Moment categories.

Experiments & Results

The authors tested eight supervised learners, ranging from Logistic Regression to Deep Neural Networks.

Key Findings:

• LightGBM Dominance: LightGBM provided the most balanced results, particularly in handling the skewed class distributions of the Bitcoin network.
• Ablation Success: Combining all three feature types yielded a 7%–10% improvement over any single category.
• Mixer Identification: The model was exceptionally good at spotting "Mixers" (services used to hide transaction trails) with an accuracy of 96%.

Table: Comparison of Micro and Macro F1 scores across different machine learning models.

Why Moments Matter: The Intuition

Why does "Third Standardized Moment" (Skewness) help catch a criminal? Consider a Mixer: it typically has a very short lifetime and a sudden burst of transactions followed by dormancy. Its "peakedness" (kurtosis) and "skewness" will look radically different from a Mining Pool, which transacts with robotic regularity over years. By feeding these mathematical shapes into LightGBM, the model learns the "behavioral physics" of the blockchain.

Figure: Information gain analysis shows that proposed Moment and Extra features dominate the top-ranking predictors.

Critical Analysis & Conclusion

This work successfully demonstrates that transaction history summarization is a computationally efficient alternative to graph-based motifs. However, the study echoes a common problem in blockchain research: Data Scarcity. The entity-based scheme struggled due to the small number of known "Market" and "Mixer" entities compared to "Exchange" addresses.

Takeaway: For developers and regulators, this paper provides a blueprint for a real-time monitoring tool. By calculating moments on-the-fly, exchanges could flag suspicious addresses the moment their "temporal fingerprint" begins to deviate from the norm.