Pith. sign in

REVIEW 3 major objections 4 minor 22 references

Hybrid GCN-GRU Model for Anomaly Detection in Cryptocurrency Transactions

T0 review · 3 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A GCN-GRU hybrid that models both transaction structure and time sequences outperforms every baseline on Wasabi Wallet Bitcoin mixing data, reaching 0.9470 accuracy and 0.9807 AUC-ROC.

desk verdict Table 3's Accuracy=Recall coincidence invalidates the headline result; the Wasabi Wallet dataset is the real contribution, and the paper needs a corrected evaluation, not a desk reject. read the letter →

arxiv 2509.07392 v1 pith:YYAETXEP submitted 2025-09-09 cs.LG cs.AI

Gyuyeon Na , Minjung Park , Hyeonjeong Cha , Soyoun Kim , Sunyoung Moon , Sua Lee , Jaeyoung Choi , Hyemin Lee
show 1 more author
Sangmi Chai
This is my paper · ORCID
classification cs.LGcs.AI
keywords cryptocurrencyanomalydetectiongraphconvolutionalnetworkgatedrecurrentunithybridGCN-GRUBitcoinmixingtransactionsillicittransactiontemporallearningWasabiWalletdataset
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that detecting illicit Bitcoin transactions improves when a model looks at both the relational structure among transactions and their evolution over time. On four years of Wasabi Wallet mixing-transaction data, the proposed GCN-GRU hybrid reports Accuracy 0.9470, Recall 0.9470, and AUC-ROC 0.9807, better on every metric than Random Forest, GCN, CNN, GCN-CNN, and GRU under identical preprocessing. The authors read this as evidence that structural and temporal cues are complementary: GCN alone lags badly, while sequence models already do well, and the hybrid closes the remaining gap. The graph branch is worth scrutiny, because the adjacency matrix is built from feature correlations between transactions (k=5 nearest neighbors, threshold 0.2), not from the actual Bitcoin transaction links described in the introduction.

What carries the argument

The load-bearing object is a per-timestep GCN feeding a GRU. For node feature matrix X (N x F) and adjacency matrix A, the GCN layer computes H(l+1) = sigma(A_hat H(l) W(l)) with A_hat = D^{-1/2}(A+I)D^{-1/2}; the GRU then updates a hidden state with update gate z_t, reset gate r_t, and candidate state h_tilde_t, and the final hidden state h_T goes through a softmax output layer. Windows of length T=10 with stride 1 are used, with GCN hidden dimension 64, GRU hidden dimension 64, k=5 nearest neighbors for the graph, correlation threshold tau=0.2, and dropout 0.1. The intended work of the GCN branch is to encode structural context at each time step, while the GRU encodes how those contexts ev

What would settle it

Train the same GCN-GRU with the feature-correlation adjacency replaced by a random graph with the same degree distribution; if AUC-ROC remains about 0.98, the GCN branch is not contributing structural signal. The sharper test is to run the hybrid on the true address-to-address transaction graph and compare AUC-ROC with and without the GRU branch.

Watch

Extended reading notes

Core claim

The central claim is that jointly modeling spatial and temporal dependencies outperforms either alone for anomaly detection in cryptocurrency transaction networks. The paper supports this with the GCN-GRU architecture: per transaction window, a graph convolutional layer transforms node features using a symmetrically normalized adjacency matrix with self-loops, and the resulting sequence of embeddings is fed into a GRU whose final hidden state is classified as normal or anomalous. On the Wasabi Wallet dataset (318,388 normal and 69,031 anomalous transactions, 2020-2024), the model achieves Accuracy 0.9470, Precision 0.9478, Recall 0.9470, F1-score 0.9474, and AUC-ROC 0.9807, the best overall

Load-bearing premise

The model's graph is built from how similar transactions look in their feature values, not from who actually sent Bitcoin to whom; if those similarity links do not reflect the structure of laundering behavior, the hybrid's gain over a sequence-only model has nothing to do with network topology.

Editorial extensions

If this is right

  • On the paper's own results, replacing a sequence-only GRU with the GCN-GRU hybrid lifts accuracy from 0.9360 to 0.9470 and AUC-ROC from 0.9786 to 0.9807, while keeping balanced precision and recall.
  • Using sliding windows with stride 1 means the model can produce a prediction for every new transaction in near real time, which the authors point toward for monitoring.
  • The same preprocessing and evaluation pipeline should transfer to other blockchain networks with labeled illicit activity, since the architecture only assumes node features and a graph.
  • The low recall of Random Forest (0.6872) versus hybrid recall (0.9470) suggests that ensemble tabular methods under-detect anomalies; the paper's comparison quantifies this gap.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the adjacency matrix is a k-NN graph over feature correlations, the GCN branch may be doing feature mixing rather than encoding real transaction topology; testing the same architecture with a random graph or with true address-to-address edges would tell which interpretation the 0.9807 AUC-ROC supports.
  • The chronological split (train 2020-2022, test 2023-2024) means the numbers include temporal generalization; if mixer behavior shifts, the gap over GRU may shrink, so a natural stress test is to evaluate on each year separately.
  • Labeling each 10-step window by its final step means some windows contain mixed normal and anomalous steps; per-step anomaly localization would require a different evaluation than window-level accuracy.
  • The approach is a natural candidate for few-shot and online adaptation to new mixer types, since the paper identifies unseen fraud patterns as a limitation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a hybrid GCN–GRU architecture for detecting anomalous (illicit) Bitcoin transactions in a Wasabi Wallet dataset spanning 2020–2024. The GCN is applied to a k-NN feature-correlation graph, and the GRU captures temporal dependencies over sliding windows. The authors report that GCN–GRU achieves the best overall results (Accuracy = 0.9470, Recall = 0.9470, AUC-ROC = 0.9807) compared with Random Forest, GCN, CNN, GCN–CNN, and GRU, and conclude that jointly modeling structural and temporal information improves anomaly detection.

Significance. If the reported results were reliable, the paper would provide a useful empirical comparison of graph–sequence hybrids for cryptocurrency anomaly detection, on a real and relatively recent dataset. However, the central claim rests entirely on Table 3, whose internal inconsistencies (Accuracy exactly equal to Recall for all five deep models) make the evaluation untrustworthy. The paper also frames the GCN as capturing transaction-network topology, while the actual adjacency is a feature-correlation graph, so the claimed 'structural' contribution is not what is described in the motivation. The absence of a described validation procedure further weakens confidence in the reported superiority. The topic is timely and the baseline comparison is broad, but the evidence as presented cannot support the paper's conclusions.

major comments (3)
  1. [Table 3, §3.4] Accuracy equals Recall to four decimals for GCN, CNN, GCN–CNN, GRU, and GCN–GRU. Under the metric definitions in §3.4, Accuracy = Recall implies TPR = TNR. Combining that with the reported Precision forces a test-set positive fraction of approximately 0.50–0.54 (e.g., for GCN–GRU, p ≈ 0.504). The full-data positive fraction is 69,031 / (318,388 + 69,031) ≈ 0.178, and the test set is reported to be 2023–2024 but its class ratio is never given. Unless the test set is roughly balanced, these numbers cannot coexist. The most plausible explanation is that the 'Recall' column actually contains Accuracy, or there is a systematic metric-calculation error. Because the paper's central claim ('best across all metrics') relies wholly on this table, the evaluation is not credible as reported. The authors must recompute and report all metrics, and provide the test-set class distribution, error bars, a
  2. [§3.3, §3.2, §1] The paper motivates the GCN as capturing structural dependencies of the 'Bitcoin transaction network,' yet the adjacency matrix is constructed as a k-NN graph over feature correlations (k=5, τ=0.2), not from the transaction graph. Thus the GCN component performs feature mixing on a similarity graph, and the reported improvement over GRU cannot be attributed to topological modeling of transaction flows. Either the graph should be built from actual transaction links (e.g., address or transaction hashes), or the claims about structural/topological learning must be revised and the feature-correlation graph justified as an appropriate structural proxy, with an ablation isolating its contribution.
  3. [§3.3, §3.4] Hyperparameters (k, τ, window size T=10, hidden dimensions d_g=d_h=64, dropout, learning rate, batch size, max epochs) are fixed 'unless otherwise stated' without any described validation set or tuning protocol. Given the chronological train/test split (2020–2022 vs. 2023–2024), there is no evidence that these choices were not selected based on test-set performance. The paper should describe a validation procedure (e.g., chronological hold-out within training, early stopping on a validation split) and report sensitivity to the key hyperparameters, especially k and τ, which determine the graph structure.
minor comments (4)
  1. [§3.4 (Reproducibility)] The reproducibility section states the dataset was provided by Kloint and mentions restrictions, but no dataset URL, access procedure, or preprocessing code is given. For a reproducibility-oriented claim, providing code and data-access details is important.
  2. [§3.3 (Proposed Model Architecture)] The description of the GCN–GRU pipeline is terse: it is unclear how the per-step GCN is applied (e.g., whether the adjacency is the same at every time step, whether node features are the transaction features at each time step, and how the sequence of GCN outputs is fed to the GRU). Figure 2 is referenced but the text is garbled and the figure is not included in the manuscript.
  3. [Table 2] The hyperparameters for the CNN, GCN–CNN, and GRU baselines are only partially specified (e.g., number of layers, strides, pooling, recurrent layers). This limits reproducibility and direct comparison with the proposed model.
  4. [General] There are several typographical and formatting issues, including 'sin ce' in §2.1, incomplete sentences around Figure 2, and inconsistent citation formatting (e.g., missing page numbers in [6], [8]). A thorough proofread is needed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity identified; reported concerns are correctness/leakage risks, not circular reductions.

full rationale

The paper's central claim—that the proposed GCN–GRU model outperforms baselines on the Wasabi Wallet dataset—is an empirical result obtained from a chronologically split test set, not a quantity derived from its own inputs by construction. The GCN and GRU equations are standard formulations attributed to external prior work (Kipf & Welling [13]; Cho et al. [14]), and there are no self-citations or imported uniqueness theorems. No parameter is described as fitted to the test labels; hyperparameters are stated without a tuning procedure, but the text nowhere claims that they were selected on the evaluation metric. The main substantive concerns are (a) the GCN adjacency matrix is constructed from feature correlations rather than the actual transaction graph, which weakens the 'structural' interpretation but is a modeling-choice/validity issue, not circularity; and (b) Table 3 shows Accuracy = Recall for all deep-learning rows, which suggests a possible metric-reporting error, but from the paper's own equations this is an inconsistency to investigate, not a reduction of the prediction to a fit. These issues affect reliability, not circularity. Accordingly, no circular step can be exhibited, and the score is 0.

Assumptions & free parameters 10 free parameters · 5 assumptions · 0 invented entities

The central claim depends mostly on hand-chosen hyperparameters, dataset label assumptions, and the feature-correlation graph construction. No new physical or conceptual entities are postulated. The most consequential choices are the graph parameters (k, tau), the windowing scheme, and the unverified assumption that preprocessing statistics stay within the training fold.

free parameters (10)
  • k (nearest neighbors in feature graph) = 5
    Chosen by hand in §3.3; controls GCN adjacency; no validation search reported.
  • tau (correlation threshold) = 0.2
    Chosen by hand in §3.3; determines edges in the feature graph.
  • GCN hidden dimension (d_g) = 64
    Hyperparameter in §3.3; no sensitivity analysis reported.
  • GRU hidden dimension (d_h) = 64
    Hyperparameter in §3.3; no sensitivity analysis reported.
  • window size T = 10
    Sliding window length chosen in §3.3 and §3.4; no justification given.
  • stride s = 1
    Creates heavily overlapping windows, inflating effective sample size; no justification given.
  • dropout rate = 0.1
    Hyperparameter in §3.3; no tuning reported.
  • learning rate = 1e-3
    Adam learning rate in §3.4; no tuning reported.
  • batch size = 256
    Training batch size in §3.4; no tuning reported.
  • max epochs = 30
    Training cap in §3.4; no early stopping or validation curve reported.
assumptions (5)
  • domain assumption Strict chronological split and stride-1 sliding windows provide independent test samples without temporal leakage.
    Stated in §3.1 and §3.4, but windows share 9 of 10 timesteps and MinMaxScaler is listed before the split, so the assumption is doubtful.
  • ad hoc to paper A k-NN feature-correlation graph (k=5, tau=0.2) is a valid structural proxy for illicit transaction topology.
    The GCN adjacency in §3.3 is built from feature correlations, not from the transaction network described in §1; no evidence supports this proxy.
  • domain assumption Mixing-related hashes provide correct labels for normal versus anomalous transactions.
    Used in §3.1 to define labels; no label audit or error analysis is reported.
  • domain assumption Preprocessing statistics (scaler bounds, graph edges) are computed on training data only.
    The paper does not say this; §3.1 normalizes before the chronological split, raising leakage risk.
  • standard math Standard GCN and GRU equations apply to the constructed inputs despite the feature-graph versus transaction-graph dimension mismatch.
    Equations in §3.3 are standard, but N (transactions) and F (features) are conflated when the graph is a feature graph.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hybrid GCN-GRU Model for Anomaly Detection in Cryptocurrency Transactions." pith.science (2026). https://pith.science/paper/YYAETXEP

@misc{pith2026250907392,
  author       = {Pith},
  title        = {Pith review of: Hybrid GCN-GRU Model for Anomaly Detection in Cryptocurrency Transactions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YYAETXEP}},
  note         = {Machine review of arXiv:2509.07392}
}
read the original abstract

Blockchain transaction networks are complex, with evolving temporal patterns and inter-node relationships. To detect illicit activities, we propose a hybrid GCN-GRU model that captures both structural and sequential features. Using real Bitcoin transaction data (2020-2024), our model achieved 0.9470 Accuracy and 0.9807 AUC-ROC, outperforming all baselines.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 14 canonical work pages

  1. [1]

    Available at: https://www.trmlabs.com/, last accessed 2025/08/04

    TRM Labs: Illicit Crypto Ecosystem Report 2025. Available at: https://www.trmlabs.com/, last accessed 2025/08/04

    work page 2025

  2. [2]

    Available at: h ttps://www.reuters.com/technology/losses-crypto-hacks-jump-22- bln-2024-report-says-2024-12-19/, last accessed 2025/08/19

    Reuters: Losses from crypto hacks jump to $2.2 bln in 2024, report says. Available at: h ttps://www.reuters.com/technology/losses-crypto-hacks-jump-22- bln-2024-report-says-2024-12-19/, last accessed 2025/08/19

    work page 2024

  3. [3]

    Available at: h ttps://www.trmlabs.com/, last accessed 2025/08/04

    TRM Labs: Crypto Crime Report 2022. Available at: h ttps://www.trmlabs.com/, last accessed 2025/08/04

    work page 2022

  4. [4]

    In: Garcia -Alfaro, J., Herrera - Joancomartí , J

    Mariani, A., Homoliak, I., Tippenhauer, N.O.: A Survey on Cryptocurrency Mixers: Techniques, Typology, and Regulation. In: Garcia -Alfaro, J., Herrera - Joancomartí , J. (eds.) TrustBus 2025, Lecture Notes in Computer Science (LNCS), vol. 13923, pp. 101–115. Springer, Heidelberg (2025). https://doi.org/10.1007/978- 3-031-47238-9_7

    doi:10.1007/978- 2025

  5. [5]

    Anomaly Detection in Bitcoin Network Using Unsupervised Learning Methods

    Pham, T. T., Lee, S. Anomaly Detection in Bitcoin Network Using Unsupervised Learning Methods. arXiv:1611.03941 (2017). https://arxiv.org/abs/1611.03941

    work page Pith review arXiv 2017

  6. [6]

    SoK: A Survey of Mixing Techniques and Mixers for Cryptocurrencies

    Mariani, J., Homoliak, I.: SoK: A Survey of Mixing Techniques and Mix- ers for Cryptocurrencies. arXiv preprint arXiv:2504.20296 (2025). Available at: https://arxiv.org/abs/2504.20296, last accessed 2025/08/04

    work page Pith review arXiv 2025

  7. [7]

    Topological Analysis of Mixer Activities in the Bitcoin Network

    Zola, F., Medina, J.A., Venturi, A., Orduna, R. Topological Analysis of Mixer Activities in the Bitcoin Network. arXiv:2504.11924v1 [cs.CR] (2025). https://arxiv.org/abs/2504.11924

    work page Pith review arXiv 2025

  8. [8]

    Journal of Current Research in Blockchain 1(1), 70 –90 (2024)

    Hariguna, T., Al-Rawahna, A.S.M.: Unsupervised Anomaly Detection in Dig- ital Currency Trading: A Clustering and Density-Based Approach Using Bit- coin Data. Journal of Current Research in Blockchain 1(1), 70 –90 (2024). https://doi.org/10.47738/jcrb.v1i1.12

    work page doi:10.47738/jcrb.v1i1.12 2024

Show all 22 references
  1. [9]

    Scientific Reports 15, 11076 (2025)

    Asiri, A., Somasundaram, K.: Graph Convolution Network for Fraud Detection in Bitcoin Transactions. Scientific Reports 15, 11076 (2025). https://doi.org/10.1038/s41598-025-95672-w

    2025 doi

  2. [10]

    Transaction Fraud Detection Using GRU-centered Sandwich-structured Model

    Li, X., Yu, W., Luwang, T., Zheng, J., Qiu, X., Zhao, J., Xia, L., Li, Y. Transaction Fraud Detection Using GRU-centered Sandwich-structured Model. In: 2018 IEEE 22nd International Conference on Computer Sup- ported Cooperative Work in Design (CSCWD), pp. 467 –472. IEEE (2018)...

    2018

  3. [11]

    Blockchain Research and Applications 5(3), 100207 (202 4)

    Hasan, M., Rahman, M.S., Janicke, H., Sarker, I.H.: Detecting Anomalies in Blockchain Transactions Using Machine Learning Classifiers and Explain - ability Analysis. Blockchain Research and Applications 5(3), 100207 (202 4). https://doi.org/10.1016/j.bcra.2024.100207

    2024

  4. [12]

    In: Susilo, W., Pieprzyk, J

    Gao, J., Badjie, A., Xia, Q., Mukala, P., Xia, H., Ntuala, G.M.: Advanced Temporal Graph Embedding for Detecting Fraudulent Transactions on Complex Blockchain Transactional Networks. In: Susilo, W., Pieprzyk, J. (eds.) ACISP 2025, Lecture Notes in Computer Science (LNCS), vol....

    2025 doi

  5. [13]

    In: International Conference on Learning Representations (ICLR) (2017)

    Kipf, T.N., Welling, M.: Semi-Supervised Classification with Graph Convolu- tional Networks. In: International Conference on Learning Representations (ICLR) (2017). Available at: https://arxiv.org/abs/1609.02907, last accessed 2025/08/04

    2017 arXiv

  6. [14]

    In: Proceedings of the 2014 Conference on Em - pirical Methods in Natural Language Processing (EMNLP), pp

    Cho, K., van Merriënboer, B., Gülçehre, Ç ., Bahdanau, D., Bougares, F., Schwenk, H., Bengio, Y.: Learning Phrase Representations using RNN Encoder –Decoder for Statistical Machine Translation. In: Proceedings of the 2014 Conference on Em - pirical Methods in Natural Language ...

    2014 arXiv

  7. [15]

    In: Proceedings of the IEEE Con - sumer Communications and Networking Conference (CCNC), pp

    Marasi, S., Ferretti, S.: Anti-Money Laundering in Cryptocurrencies Through Graph Neural Networks: A Comparative Study. In: Proceedings of the IEEE Con - sumer Communications and Networking Conference (CCNC), pp. 272–277 (2024). https://doi.org/10.1109/CCNC51664.2024.10454631

    2024

  8. [16]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), pp

    Zhang, C., Song, D., Chen, Y., Feng, X., Lumezanu, C., Cheng, W., Ni, J.: A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data. In: Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), pp. 1409 –1416 (2019). h...

    2019 doi

  9. [17]

    Scientific Reports 15, 23694 (2025)

    Aly, M., Behiry, M.H.: Enhancing Anomaly Detection in IoT-Driven Fac- tories Using Logistic Boosting, Random Forest, and SVM: A Compar- ative Machine Learning Approach. Scientific Reports 15, 23694 (2025). https://doi.org/10.1038/s41598-025-23694-y

    2025 doi

  10. [18]

    Why Should I Trust You?

    Ribeiro, M.T., Singh, S., Guestrin, C.: "Why Should I Trust You?": Explaining the Predictions of Any Classifier. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pp. 1135–1144 (2016). https://doi.org/10.1145/2939672.2939778

    2016

  11. [19]

    In: Proceedings of the 29th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pp

    Elmougy, Y., Liu, L.: Demystifying Fraudulent Transactions and Illicit Nodes in the Bitcoin Network for Financial Forensics. In: Proceedings of the 29th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), pp. 1 – 16 (2023). https://doi.org/10.1145...

    2023

  12. [20]

    IEEE Transactions on Intelligent Transportation Systems 21(9), 3848–3858 (2020)

    Zhao, L., Song, Y., Zhang, C., Liu, Y., Wang, P., Lin, T., Deng, M., Li, H.: T -GCN: A Temporal Graph Convolutional Network for Traffic Prediction. IEEE Transactions on Intelligent Transportation Systems 21(9), 3848–3858 (2020). https://doi.org/10.1109/TITS.2019.2935152

    2020

  13. [21]

    IEEE Access, PP(99):1 –1 (2025)

    Ferretti, S., D’Angelo, G., Ghini, V.: Enhancing Anti-Money Launder- ing Frameworks: An Application of Graph Neural Networks in Cryp- tocurrency Transaction Classification. IEEE Access, PP(99):1 –1 (2025). https://doi.org/10.1109/ACCESS.2025.3552240

    2025

  14. [22]

    In: Proceedings of the IEEE International Conference on Data Mining (ICDM), pp

    Xie, M., Zhao, L.: Hybrid temporal -structural models for blockchain anomaly de - tection. In: Proceedings of the IEEE International Conference on Data Mining (ICDM), pp. 456–463. IEEE (2022)

    2022

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.