# From Asset Flow to Status, Action and Intention Discovery: Early Malice Detection in Cryptocurrency

arXiv: https://arxiv.org/abs/2309.15133 · HTML: https://mlsanity.com/paper/2309.15133/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 61 references that are in the map.
- First posted on arXiv 26 Sep 2023.

## Builds on (most cited first, 19 of 19)

- [On the Properties of Neural Machine Translation: Encoder-Decoder Approaches](https://mlsanity.com/paper/1409.1259/) (2014)
- [Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics](https://mlsanity.com/paper/1908.02591/) (2019)
- [Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding](https://mlsanity.com/paper/1911.09259/) (2019)
- [CED: Credible Early Detection of Social Media Rumors](https://mlsanity.com/paper/1811.04175/) (2018)
- [A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses](https://mlsanity.com/paper/1908.04507/) (2019)
- [Detecting Mixing Services via Mining Bitcoin Transaction Network with Hybrid Motifs](https://mlsanity.com/paper/2001.05233/) (2020)
- [T-EDGE: Temporal WEighted MultiDiGraph Embedding for Ethereum Transaction Network Analysis](https://mlsanity.com/paper/1905.08038/) (2019)
- [TTAGN: Temporal Transaction Aggregation Graph Network for Ethereum Phishing Scams Detection](https://mlsanity.com/paper/2204.13442/) (2022)
- [Data mining for detecting Bitcoin Ponzi schemes](https://mlsanity.com/paper/1803.00646/) (2018)
- [BitcoinHeist: Topological Data Analysis for Ransomware Detection on the Bitcoin Blockchain](https://mlsanity.com/paper/1906.07852/) (2019)
- [Ransomware Payments in the Bitcoin Ecosystem](https://mlsanity.com/paper/1804.04080/) (2018)
- [Modeling and Understanding Ethereum Transaction Records via a Complex Network Approach](https://mlsanity.com/paper/2012.15462/) (2020)
- [Identifying Illicit Accounts in Large Scale E-payment Networks -- A Graph Representation Learning Approach](https://mlsanity.com/paper/1906.05546/) (2019)
- [ChainNet: Learning on Blockchain Graphs with Topological Features](https://mlsanity.com/paper/1908.06971/) (2019)
- [On the Economic Significance of Ransomware Campaigns: A Bitcoin Transactions Perspective](https://mlsanity.com/paper/1804.01341/) (2018)
- [SAFE: A Neural Survival Analysis Model for Fraud Early Detection](https://mlsanity.com/paper/1809.04683/) (2018)
- [Bitcoin Transaction Graph Analysis](https://mlsanity.com/paper/1502.01657/) (2015)
- [Anomaly Detection in the Bitcoin System - A Network Perspective](https://mlsanity.com/paper/1611.03942/) (2016)
- [Wikipedia Vandal Early Detection: from User Behavior to User Embedding](https://mlsanity.com/paper/1706.00887/) (2017)

## Built on by (most cited first, 1 of 1)

- [Fishing for Phishers: Learning-Based Phishing Detection in Ethereum Transactions](https://mlsanity.com/paper/2504.17953/) (2025)

## Abstract (arXiv)

Cryptocurrency has been subject to illicit activities probably more often than traditional financial assets due to the pseudo-anonymous nature of its transacting entities. An ideal detection model is expected to achieve all three critical properties of (I) early detection, (II) good interpretability, and (III) versatility for various illicit activities. However, existing solutions cannot meet all these requirements, as most of them heavily rely on deep learning without interpretability and are only available for retrospective analysis of a specific illicit type. To tackle all these challenges, we propose Intention-Monitor for early malice detection in Bitcoin (BTC), where the on-chain record data for a certain address are much scarcer than other cryptocurrency platforms. We first define asset transfer paths with the Decision-Tree based feature Selection and Complement (DT-SC) to build different feature sets for different malice types. Then, the Status/Action Proposal Module (S/A-PM) and the Intention-VAE module generate the status, action, intent-snippet, and hidden intent-snippet embedding. With all these modules, our model is highly interpretable and can detect various illegal activities. Moreover, well-designed loss functions further enhance the prediction speed and model's interpretability. Extensive experiments on three real-world datasets demonstrate that our proposed algorithm outperforms the state-of-the-art methods. Furthermore, additional case studies justify our model can not only explain existing illicit patterns but can also find new suspicious characters.