The Shape of Money Laundering: Subgraph Representation Learning on the Blockchain with the Elliptic2 Dataset

TL;DR

This paper introduces Elliptic2, a large-scale blockchain graph dataset designed to enable subgraph representation learning for AML in cryptocurrency networks. It demonstrates that subgraph-level models, particularly GLASS, can outperform node-focused baselines by leveraging the background graph to identify illicit money-laundering shapes. The work provides substantial dataset resources, scalable training strategies via SALIENT/SALIENT++, and external corroboration through real-world investigations and known laundering motifs, highlighting practical implications for forensics and compliance. Overall, Elliptic2 offers a new standard for subgraph AML analytics and a benchmark for scalable, real-world graph learning on financial networks.

Abstract

Subgraph representation learning is a technique for analyzing local structures (or shapes) within complex networks. Enabled by recent developments in scalable Graph Neural Networks (GNNs), this approach encodes relational information at a subgroup level (multiple connected nodes) rather than at a node level of abstraction. We posit that certain domain applications, such as anti-money laundering (AML), are inherently subgraph problems and mainstream graph techniques have been operating at a suboptimal level of abstraction. This is due in part to the scarcity of annotated datasets of real-world size and complexity, as well as the lack of software tools for managing subgraph GNN workflows at scale. To enable work in fundamental algorithms as well as domain applications in AML and beyond, we introduce Elliptic2, a large graph dataset containing 122K labeled subgraphs of Bitcoin clusters within a background graph consisting of 49M node clusters and 196M edge transactions. The dataset provides subgraphs known to be linked to illicit activity for learning the set of "shapes" that money laundering exhibits in cryptocurrency and accurately classifying new criminal activity. Along with the dataset we share our graph techniques, software tooling, promising early experimental results, and new domain insights already gleaned from this approach. Taken together, we find immediate practical value in this approach and the potential for a new standard in anti-money laundering and forensic analytics in cryptocurrencies and other financial networks.

Figures (3)

• Figure 1: Illustrative example of the dataset, with its background graph and annotated subgraphs. Each node represents a Bitcoin cluster, a collection of Bitcoin addresses controlled by the same entity, and each edge representing a transaction between them.
• Figure 2: Construction of the dataset requires labeling paths first and then labeling subgraphs. In the example above, there are 3 licit paths (I. 13 $\rightarrow$ 14 $\rightarrow$ 15 $\rightarrow$ 19; II. 16 $\rightarrow$ 17 $\rightarrow$ 15 $\rightarrow$ 19; III. 23 $\rightarrow$ 22 $\rightarrow$ 24), 1 illicit path (1 $\rightarrow$ 7 $\rightarrow$ 4 $\rightarrow$ 5 $\rightarrow$ 6), 3 suspicious paths (I. 1 $\rightarrow$ 7 $\rightarrow$ 8 $\rightarrow$ 9 $\rightarrow$ 12; II. 1 $\rightarrow$ 7 $\rightarrow$ 8 $\rightarrow$ 10 $\rightarrow$ 11 $\rightarrow$ 12; III. 20 $\rightarrow$ 21 $\rightarrow$ 22 $\rightarrow$ 24), and 1 neutral path (1 $\rightarrow$ 2 $\rightarrow$ 3). The result is one licit subgraph and one suspicious subgraph (note that the subgraph 21,22 is unlabeled as it is made of both a suspicious and a licit path).
• Figure 3: Example of a size-3 suspicious subgraph, connecting the profits of a scam to two exchanges (Note: the label categories are not available in the dataset).

Theorems & Definitions (2)

• definition 1
• definition 2