Elliptic++ Bitcoin Dataset

• Elliptic++ dataset is a comprehensive Bitcoin transaction and actor dataset enriched with multi-view graph modalities, detailed annotations, and temporal structure.
• It facilitates both transaction- and actor-level anomaly detection by supporting advanced machine learning methods with high precision and recall metrics.
• The dataset integrates multiple CSV formats and graph representations, enabling diverse applications from forensic analysis to graph neural network research.

The Elliptic++ dataset is a large-scale, real-world labeled Bitcoin transaction and actor dataset purpose-built for financial forensic research, in particular for machine learning–driven fraud and anti-money laundering (AML) detection. As an extension of the original Elliptic dataset, Elliptic++ incorporates extensive address-level annotation, multi-view graph structures, and rich feature sets facilitating both transaction- and actor-level anomaly detection. It is complemented in scope by the later Elliptic2 dataset, which addresses subgraph-structured AML problems at even greater scale by constructing annotated subgraphs of entity clusters. These resources form benchmarks for graph-based, temporal, and subgraph learning methods in financial forensics (Elmougy et al., 2023, Bellei et al., 2024).

1. Dataset Scale, Structure, and Scope

Elliptic++ comprises 203,769 unique Bitcoin transactions and 822,942 wallet addresses (referred to as actors) spanning 49 contiguous time steps, together generating 1,268,260 address–time-step occurrences. The dataset encodes three principal edge sets: 234,355 transaction-to-transaction directed money-flow edges; over 1.3 million address–address transactional interactions (with potentially multiple parallel edges for multi-transaction pairs); and bipartite address–transaction edges (input_address→transaction and transaction→output_address) for the full temporal horizon. The temporal coverage mirrors that of the original Elliptic dataset (approximately April 2013–January 2018).

Each transaction and address is organized according to one of four directed graph modalities:

Graph View	Nodes	Edge Definition
Transaction-to-Transaction	T (transactions)	(tᵢ→tⱼ): output of tᵢ used as input of tⱼ
Address-to-Address	A (addresses)	(aᵢ→aⱼ): aᵢ input, aⱼ output in the same transaction (parallel edges for repeatings)
Address–Transaction (Bipartite)	A ∪ T	(a→t) if a is input to t; (t→a) if a is output of t
User-Entity (Cluster)	U (address clusters)	(Uₚ→U_q): ∃t with a∈Uₚ input and a′∈U_q output of t (clustered via multiple-input heuristic)

Each address is annotated with 56 features capturing transaction, temporal, network-structural, and labeling aspects. The dataset is distributed as modular CSV tables (transaction features, address features, edge lists, class assignments), loadable via standard data science frameworks (pandas, NetworkX, PyTorch-Geometric, DGL) (Elmougy et al., 2023).

2. Multi-view Graph Representations

The four graph formulations serve complementary analytic purposes:

1. Transaction-to-Transaction Graph (G_tt = (T, E_tt)): Captures explicit flow of BTC via output-to-input linkage, directly supporting money flow tracing and transaction-level anomaly detection.
2. Address-to-Address Graph (G_aa = (A, E_aa)): Reveals the interaction patterns between address pairs, exposing transactional counterparty relationships and facilitating detection of illicit actor behaviors.
3. Bipartite Address–Transaction Graph (G_at = (A∪T, E_at)): Encodes full money movement between addresses and transactions, accommodating bidirectional BTC flow representation critical to actor-centric forensics.
4. User-Entity (Address Cluster) Graph (G_uu = (U, E_uu)): Utilizes the multiple-input heuristic to cluster addresses believed to belong to a single user. Edges (Uₚ→U_q) model cross-entity funds transfer, enabling entity-level risk assessment and de-anonymization analysis. Partitioning addresses into clusters lays the foundation for detailed "chain of custody" investigations.

Each modality allows for the construction of graph objects suitable for advanced processing by graph machine learning algorithms, including Graph Neural Networks (GNNs) and their heterogeneous or temporal extensions.

3. Feature Engineering and Label Structure

The 56 address (actor) features, as grouped in the original source, are as follows:

• Transaction-related (20 features): For all appearances of an address, five summary statistics (total, min, max, mean, median) each for BTC_transacted, BTC_sent, BTC_received, and Fees.
• Fees_share (5 features): Fees / BTC_transacted, summarized across transactions as above.
• Time-related (20 features): For multiple aspects of transaction timing (block-height deltas, number of unique counterparties per transaction), with the same five statistics each.
• Singleton features (11 features): Includes class label ({illicit, licit, unknown}); transaction counts (overall, as input, as output); time steps active, lifespan; block indices; repeat interaction counts.

Class annotations are available for both transactions and addresses, allowing for supervised and semi-supervised learning protocols.

4. Fraud Detection Benchmarks and Results

Standardized evaluation is conducted via a temporal 70/30 split (time steps 1–34 for training, 35–49 for testing). Several baseline and ensemble machine learning models are implemented: Logistic Regression (LR), Random Forest (RF), Multilayer Perceptron (MLP), Long Short-Term Memory (LSTM), XGBoost (XGB), with both binary and ensemble majority voting.

Key reported metrics (Precision, Recall, F1, Micro-avg F1, MCC) are as follows:

Task	Model(s)	Precision (%)	Recall (%)	F1	Micro-F1	Comments
Transaction-level	RF	97.5	71.9	0.828	0.980	Outperforms original Elliptic dataset
Transaction-level	RF+XGB (2-ensemble)	97.7	70.6	–	–	Majority voting
Transaction-level	RF (top 10 features)	98.6	72.7	–	–	Aggressive feature selection
Actor-level	RF	91.1	78.9	0.845	0.990	Robust to class imbalance
Actor-level	RF+XGB (2-ensemble)	95.9	53.0	–	–	Favoring precision over recall
Actor-level	RF (top actor features)	92.1	80.2	–	–	Post-refinement

The enhanced feature sets and inclusion of address–transaction graphs measurably increased detection rates for both illicit transactions and actors. Emphasis is placed on optimizing for higher recall in AML contexts due to the cost of false negatives (Elmougy et al., 2023).

5. Data Formats, Loading, and Tooling

Elliptic++ is made accessible as a suite of CSV files containing:

• Transaction features (txs_features.csv): 203,769 rows × 183 cols (txId, TS, 93 local features, 72 aggregate, 17 augmented).
• Transaction edges (txs_edgelist.csv), class annotations (txs_classes.csv).
• Address features (wallets_features.csv: 822,942 rows × 58 cols), class labels (wallets_classes.csv).
• Address–address, address–transaction, transaction–address edge lists for the corresponding graph modalities.

Any CSV reader (such as pandas) can be used to instantiate standard graph objects (NetworkX, Graph-tool), or for conversion to machine learning frameworks supporting heterogeneous graphs (PyTorch-Geometric, DGL). Example Jupyter notebooks are provided to facilitate reproduction and extensibility (Elmougy et al., 2023).

6. Impact, Domain Insights, and Research Directions

Elliptic++ provides standardized, real-world benchmarks for fraud detection and AML analytics involving heterogeneous, temporal, and cluster-based graph data. Increases in recall and precision upon integration of actor-level and address–transaction features suggest that multi-view and cluster-level (user entity) approaches are essential for capturing the complexity of illicit behaviors.

The clustering of addresses via the multiple-input heuristic enables advanced de-anonymization and chain-of-custody analyses, underpinning forensic traceability workflows. The dataset’s scale and annotation density support benchmarking for a range of graph-centric models, including GNNs, self-supervised learning, and active (human-in-the-loop) approaches.

Recommendations for future work include: expansion to other blockchain platforms (Ethereum, ZCash, Monero), incorporation of off-chain metadata, and adaptation to streaming/online compliance detection. The introduction of Elliptic2 extends the paradigm by providing 121,810 labeled subgraphs of Bitcoin clusters (out of a background graph with 49 million clusters and 196 million edges), leveraging path-based and component-based subgraph labeling for AML analytics at scale (Bellei et al., 2024).

Both datasets facilitate real-time compliance scoring, prioritized forensic investigation, and continuous monitoring in regulated environments, and together serve as benchmarks for future research in subgraph representation learning and graph-based anti-money laundering methodologies.