# Evolve Path Tracer: Early Detection of Malicious Addresses in Cryptocurrency

arXiv: https://arxiv.org/abs/2301.05412 · HTML: https://mlsanity.com/paper/2301.05412/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 49 references that are in the map.
- First posted on arXiv 13 Jan 2023.

## Builds on (most cited first, 21 of 21)

- [On the Properties of Neural Machine Translation: Encoder-Decoder Approaches](https://mlsanity.com/paper/1409.1259/) (2014)
- [EvolveGCN: Evolving Graph Convolutional Networks for Dynamic Graphs](https://mlsanity.com/paper/1902.10191/) (2019)
- [Rethinking Graph Neural Networks for Anomaly Detection](https://mlsanity.com/paper/2205.15508/) (2022)
- [Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics](https://mlsanity.com/paper/1908.02591/) (2019)
- [Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding](https://mlsanity.com/paper/1911.09259/) (2019)
- [CED: Credible Early Detection of Social Media Rumors](https://mlsanity.com/paper/1811.04175/) (2018)
- [Detecting Mixing Services via Mining Bitcoin Transaction Network with Hybrid Motifs](https://mlsanity.com/paper/2001.05233/) (2020)
- [T-EDGE: Temporal WEighted MultiDiGraph Embedding for Ethereum Transaction Network Analysis](https://mlsanity.com/paper/1905.08038/) (2019)
- [TTAGN: Temporal Transaction Aggregation Graph Network for Ethereum Phishing Scams Detection](https://mlsanity.com/paper/2204.13442/) (2022)
- [AntiBenford Subgraphs: Unsupervised Anomaly Detection in Financial Networks](https://mlsanity.com/paper/2205.13426/) (2022)
- [Ransomware Payments in the Bitcoin Ecosystem](https://mlsanity.com/paper/1804.04080/) (2018)
- [BlockSci: Design and applications of a blockchain analysis platform](https://mlsanity.com/paper/1709.02489/) (2017)
- [Identifying Illicit Accounts in Large Scale E-payment Networks -- A Graph Representation Learning Approach](https://mlsanity.com/paper/1906.05546/) (2019)
- [Graph Anomaly Detection with Unsupervised GNNs](https://mlsanity.com/paper/2210.09535/) (2022)
- [SAFE: A Neural Survival Analysis Model for Fraud Early Detection](https://mlsanity.com/paper/1809.04683/) (2018)
- [Characterizing Entities in the Bitcoin Blockchain](https://mlsanity.com/paper/1810.11956/) (2018)
- [D.MCA: Outlier Detection with Explicit Micro-Cluster Assignments](https://mlsanity.com/paper/2210.08212/) (2022)
- [Temporal anomaly detection: calibrating the surprise](https://mlsanity.com/paper/1705.10085/) (2017)
- [Wikipedia Vandal Early Detection: from User Behavior to User Embedding](https://mlsanity.com/paper/1706.00887/) (2017)
- [BL-MNE: Emerging Heterogeneous Social Network Embedding through Broad Learning with Aligned Autoencoder](https://mlsanity.com/paper/1711.09409/) (2017)
- [Automated Ransomware Behavior Analysis: Pattern Extraction and Early Detection](https://mlsanity.com/paper/1910.06469/) (2019)

## Built on by (most cited first, 5 of 5)

- [Machine Learning for Blockchain Data Analysis: Progress and Opportunities](https://mlsanity.com/paper/2404.18251/) (2024)
- [Detecting Rug Pulls in Decentralized Exchanges: Machine Learning Evidence from the TON Blockchain](https://mlsanity.com/paper/2509.01168/) (2025)
- [Slow is Fast! Dissecting Ethereum's Slow Liquidity Drain Scams](https://mlsanity.com/paper/2503.04850/) (2025)
- [Fishing for Phishers: Learning-Based Phishing Detection in Ethereum Transactions](https://mlsanity.com/paper/2504.17953/) (2025)
- [Interpreting Graph Inference with Skyline Explanations](https://mlsanity.com/paper/2505.07635/) (2025)

## Abstract (arXiv)

With the ever-increasing boom of Cryptocurrency, detecting fraudulent behaviors and associated malicious addresses draws significant research effort. However, most existing studies still rely on the full history features or full-fledged address transaction networks, thus cannot meet the requirements of early malicious address detection, which is urgent but seldom discussed by existing studies. To detect fraud behaviors of malicious addresses in the early stage, we present Evolve Path Tracer, which consists of Evolve Path Encoder LSTM, Evolve Path Graph GCN, and Hierarchical Survival Predictor. Specifically, in addition to the general address features, we propose asset transfer paths and corresponding path graphs to characterize early transaction patterns. Further, since the transaction patterns are changing rapidly during the early stage, we propose Evolve Path Encoder LSTM and Evolve Path Graph GCN to encode asset transfer path and path graph under an evolving structure setting. Hierarchical Survival Predictor then predicts addresses' labels with nice scalability and faster prediction speed. We investigate the effectiveness and versatility of Evolve Path Tracer on three real-world illicit bitcoin datasets. Our experimental results demonstrate that Evolve Path Tracer outperforms the state-of-the-art methods. Extensive scalability experiments demonstrate the model's adaptivity under a dynamic prediction setting.