Insights and caveats from mining local and global temporal motifs in cryptocurrency transaction networks

TL;DR

This work uses temporal motifs to analyse two Bitcoin datasets and one NFT dataset, using sequences of three transactions and up to three users, and finds events and anomalous activity that cannot be seen just by a count on the whole dataset.

Abstract

Distributed ledger technologies have opened up a wealth of fine-grained transaction data from cryptocurrencies like Bitcoin and Ethereum. This allows research into problems like anomaly detection, anti-money laundering, pattern mining and activity clustering (where data from traditional currencies is rarely available). The formalism of temporal networks offers a natural way of representing this data and offers access to a wealth of metrics and models. However, the large scale of the data presents a challenge using standard graph analysis techniques. We use temporal motifs to analyse two Bitcoin datasets and one NFT dataset, using sequences of three transactions and up to three users. We show that the commonly used technique of simply counting temporal motifs over all users and all time can give misleading conclusions. Here we also study the motifs contributed by each user and discover that the motif distribution is heavy-tailed and that the key players have diverse motif signatures. We study the motifs that occur in different time periods and find events and anomalous activity that cannot be seen just by a count on the whole dataset. Studying motif completion time reveals dynamics driven by human behaviour as well as algorithmic behaviour.

Figures (9)

• Figure 1: An example of extracting a particular temporal motif from a temporal graph. (a) is an example of $\delta$-temporal motif $M$ with a given $\delta=10$; (b) is a temporal graph with edges appearing at the times shown on each edge; (c) shows an instance of $\delta$-temporal motifs in the temporal graph; (d) is not a $\delta$-temporal motif because the difference between the timestamp of the first temporal edge and the timestamp of the last temporal edge exceeds the given $\delta$.
• Figure 2: Possible three-edge up-to-three node motifs considered in this work, using the same enumeration as in Paranjape et al paranjape2017motifs with added colouring to indicate sub-types. For local motif counts, we consider an additional four two-node motifs which are exactly those pictured but with directions reversed (the direction becomes important when counting from the perspective of a node).
• Figure 3: Local motif counts for nodes in the Alphabay network with $\delta$ set to one hour. The plot shows total motif count versus total transactions (both incoming and outgoing). The nodes are coloured by their wallet balance (total incoming transaction value minus total outgoing transaction value). Note the scale is logarithmic in both axes and in the colouring.
• Figure 4: Global motif counts for each dataset (top) compared with a null time shuffled model (bottom) where the lower graphs show the ratio of motif count in the unshuffled versus shuffled data. (See text for axes interpretation.)
• Figure 5: Complementary cumulative distribution function of the motifs each node participates in, grouped into categories of similar motifs for Alphabay and Hydra and NFT. Both axes are log-scaled.