Correlating Account on Ethereum Mixing Service via Domain-Invariant feature learning

TL;DR

StealthLink addresses the challenge of tracing Ethereum mixing transactions under limited labeled data by transferring knowledge from malicious-account detection to coin-mixing tracing through cross-task invariant feature learning. The framework combines MixFusion for subgraph-based embedding of mixing patterns with a cross-task knowledge transfer mechanism that aligns source and target representations without requiring abundant labeled data. Empirical results on real-world Tornado Cash data demonstrate state-of-the-art performance, particularly in few-shot, noisy-label, and imbalanced settings, achieving high F1-scores and robust generalization. This work delivers a practical blockchain forensics solution with potential for extension to cross-chain tracing and broader anomaly detection in decentralized ecosystems.

Abstract

The untraceability of transactions facilitated by Ethereum mixing services like Tornado Cash poses significant challenges to blockchain security and financial regulation. Existing methods for correlating mixing accounts suffer from limited labeled data and vulnerability to noisy annotations, which restrict their practical applicability. In this paper, we propose StealthLink, a novel framework that addresses these limitations through cross-task domain-invariant feature learning. Our key innovation lies in transferring knowledge from the well-studied domain of blockchain anomaly detection to the data-scarce task of mixing transaction tracing. Specifically, we design a MixFusion module that constructs and encodes mixing subgraphs to capture local transactional patterns, while introducing a knowledge transfer mechanism that aligns discriminative features across domains through adversarial discrepancy minimization. This dual approach enables robust feature learning under label scarcity and distribution shifts. Extensive experiments on real-world mixing transaction datasets demonstrate that StealthLink achieves state-of-the-art performance, with 96.98\% F1-score in 10-shot learning scenarios. Notably, our framework shows superior generalization capability in imbalanced data conditions than conventional supervised methods. This work establishes the first systematic approach for cross-domain knowledge transfer in blockchain forensics, providing a practical solution for combating privacy-enhanced financial crimes in decentralized ecosystems.

Figures (5)

• Figure 1: Tornado Cash is abused for illegal behavior.
• Figure 2: The data distribution of the two domains is highly overlapping.
• Figure 3: Overview of the StealthLink System
• Figure 4: Relationship between label noise rate and performance degradation rate
• Figure 5: Visualization of sample embeddings under the transfer learning framework.