Bitcoin Fraud Detection via Multi-Party Federated Prediction Fusion

Research Question

Can federated multi-party learning detect fraudulent Bitcoin addresses that aren't yet in any known database, by combining behavioral, graph, and threat intelligence signals?

Architecture

Three simulated financial institutions each hold different data about the same Bitcoin addresses. They collaborate by sharing predictions only — no raw data ever leaves a bank.

Bank	Role	Data	Features
A	Exchange	On-chain behavioral	Tx counts, volumes, balances, ratios
B	Analytics	Address structural	Address type, flags, entropy
C	Threat Intel	Fraud databases	OFAC/Chainabuse flags
Fusion	Multi-Party	Predictions only	Weighted avg of P(A), P(B), P(C)
Oracle	Upper Bound	All pooled	Privacy-violating baseline

Hold-Out Evaluation Protocol (Key Innovation)

1. 19K+ confirmed fraud addresses from OFAC SDN + Chainabuse
2. 70/30 split: 70% = "known" (Bank C training), 30% = "held-out" (undiscovered)
3. Recent block transactions as unlabeled baseline (presumed clean)
4. Key test: Can Banks A+B detect the held-out 30% that Bank C has never seen?

This is the PU-learning (Positive-Unlabeled) framing — an established methodology for fraud detection where confirmed negatives don't exist.

Data Sources

• OFAC SDN List: U.S. Treasury sanctioned Bitcoin addresses
• Chainabuse: Community-reported fraud addresses (~38K scraped)
• Live Blockchain: Recent block transactions from mempool.space API

NO synthetic data. All addresses are real. Class imbalance is handled via class_weight='balanced'.

Pipeline

01_data_collection.py     → Build fraud address database (OFAC + Chainabuse)
02_build_dataset.py       → Hold-out split + collect block txs + fetch features
03_federated_fusion.py    → Main experiment: 5-fold CV + holdout detection
04_ablations.py           → Confound test + coverage sweep + model comparison

Running

cd notebooks

# Step 1: Build fraud database (needs internet for OFAC)
python 01_data_collection.py

# Step 2: Build dataset (needs internet for mempool.space)
# This fetches on-chain features — cached, so re-runs are fast
python 02_build_dataset.py

# Step 3: Main experiment (offline — uses cached data)
python 03_federated_fusion.py

# Step 4: Ablation studies (offline)
python 04_ablations.py

Key Experiments

Experiment 1: Standard 5-Fold CV

Train on known fraud + unlabeled. Standard classification metrics. Establishes baseline AUC/PR-AUC for each bank and fusion.

Experiment 2: Holdout Fraud Detection (THE KEY RESULT)

Train on known fraud + half unlabeled. Test on holdout fraud + other half unlabeled. If Fusion AUC > Bank C AUC → behavioral signals detect unseen fraud.

Ablation Studies

1. Address-type confound: Remove address format features to test for era bias
2. Coverage sweep: Bank C knows 10%–90% of fraud — how does fusion cope?
3. Model comparison: RF vs XGBoost vs LightGBM vs Logistic Regression

Dependencies

pip install pandas numpy scikit-learn matplotlib requests beautifulsoup4 lxml
pip install xgboost lightgbm  # optional but recommended

Outputs

• data/results/exp1_standard_cv_results.csv — Experiment 1 metrics
• data/results/exp2_holdout_results.csv — Experiment 2 metrics
• data/results/figures/exp1_standard_cv.png — ROC/PR curves (standard CV)
• data/results/figures/exp2_holdout_detection.png — ROC/PR curves (holdout)
• data/results/figures/feature_importance.png — Feature importance by bank
• data/results/figures/ablation_coverage_sweep.png — Coverage sweep plot