MPOCryptoML: Off-Chain Crypto Laundering Detection

• MPOCryptoML is a multi-pattern detection model that represents transactions as a directed, weighted, time-stamped graph to capture off-chain laundering behaviors.
• It integrates multi-source Personalized PageRank with explicit motif detectors—such as fan-in, fan-out, and bipartite structures—to quantify temporal and volume asymmetries.
• Experimental evaluations on Elliptic++, Ethereum, and Wormhole datasets show performance improvements of up to 10% over existing methods.

MPOCryptoML is a multi-pattern based off-chain crypto money laundering detection model that represents transactional activity as a directed, weighted, time-stamped graph $G=(V,E,W,T)$ and combines multi-source Personalized PageRank, timestamp- and weight-based pattern detectors, logistic regression, and an anomaly-ranking function to identify high-risk accounts. It is designed for off-chain settings in which laundering behavior may traverse centralized exchanges, OTC desks, custodial wallets, or cross-chain bridge systems, and it targets random laundering patterns together with fan-in, fan-out, bipartite, gather-scatter, and stack structures. On Elliptic++, Ethereum fraud detection, and Wormhole transaction data, the reported results show improvements of up to $9.13\%$ in precision, up to $10.16\%$ in recall, up to $7.63\%$ in F1-score, and up to $10.19\%$ in accuracy (Samadi et al., 18 Aug 2025).

1. Problem setting and conceptual scope

MPOCryptoML is motivated by a specific detection gap: existing models are described as not being explicitly designed to detect the diverse patterns of off-chain cryptocurrency money laundering. In the model’s formulation, “off-chain” denotes transactions or asset movements that are not directly recorded on a public blockchain ledger, including centralized exchanges, OTC desks, custodial wallets, and the off-chain state associated with cross-chain bridges. The framework treats laundering behavior as a family of graph motifs embedded in a directed transaction network rather than as a single anomaly class (Samadi et al., 18 Aug 2025).

The targeted patterns are structurally distinct. Fan-in corresponds to many sources sending funds to one sink; fan-out reverses this pattern through one-to-many dispersal; bipartite laundering is expressed as interactions between two disjoint node sets with suppressed intra-set transfers; gather-scatter combines short-horizon aggregation with rapid redistribution; and stack patterns correspond to chained relay paths across multiple intermediaries. The stated premise is that neglecting any one of these structures creates detection gaps because each pattern encodes a different obfuscation tactic.

A central methodological point is that MPOCryptoML is not presented as a graph neural network. The motivating discussion explicitly notes that existing GNN-based and on-chain-only approaches can miss off-chain flows, can under-detect evolving multi-pattern behavior, and can degrade when labels are sparse or semantics are inconsistent. MPOCryptoML instead assembles specialized modules for diffusion, temporal asymmetry, volume imbalance, and cross-pattern correlation.

2. Graph representation and end-to-end pipeline

The model begins from raw transactions of the form $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$, maps addresses to nodes $V$, and builds a directed graph with edge set $E$, weight matrix $W$, and edge timestamps $T$. Amount normalization can be applied by global z-score or min-max normalization per time window. Events are then partitioned into time windows of length $9.13\%$0, with either sliding-window or tumbling-window operation supported in the described pipeline (Samadi et al., 18 Aug 2025).

Seed selection drives the diffusion stage. The seed set $9.13\%$1 is defined by multi-source inputs such as nodes with zero in-degree or known risk addresses. With row-stochastic transition matrix

$9.13\%$2

and personalization vector

$9.13\%$3

the model computes Personalized PageRank via

$9.13\%$4

The closed-form representation

$9.13\%$5

is given, but the implementation uses an approximate multi-source PPR procedure based on forward-push with Monte Carlo refinement.

For each seed $9.13\%$6, the walk budget is

$9.13\%$7

Forward-push proceeds while there exists a node $9.13\%$8 such that $9.13\%$9 and $10.16\%$0, after which residual mass is handled by random walks. The outputs are an aggregated PPR score $10.16\%$1, a stored score set SPS, and a visited-node set SVN. The remainder of the pipeline operates on SVN rather than on the full graph.

At the systems level, the pipeline is explicitly staged: data ingestion, graph construction, time windowing, seed selection, multi-source PPR, pattern-feature computation, logistic-regression-based correlation analysis, anomaly scoring, and final top-$10.16\%$2 ranking. Sparse adjacency structures, per-node time-sorted edge lists, residual caching, $10.16\%$3-hop truncation for forward-push, and batching of Monte Carlo walks are listed as engineering mechanisms for scale.

3. Pattern detectors and feature construction

The timestamp and weight modules are node-centric statistics computed on each window $10.16\%$4. For node $10.16\%$5, inbound and outbound timestamp spreads are

$10.16\%$6

which induce the temporal asymmetry score

$10.16\%$7

Similarly, inbound and outbound volume are

$10.16\%$8

which induce

$10.16\%$9

These normalized quantities are the principal low-dimensional features later consumed by logistic regression (Samadi et al., 18 Aug 2025).

Pattern recognition is then expressed through explicit graph conditions. Fan-in is associated with high inbound degree $7.63\%$0, large $7.63\%$1, and often small $7.63\%$2 indicating rapid aggregation. Fan-out is the corresponding high out-degree and high $7.63\%$3 case. Gather-scatter is modeled as a two-phase process with a gather window $7.63\%$4, a scatter window $7.63\%$5, and a latency condition requiring the median outbound time minus the median inbound time to remain below $7.63\%$6. Bipartite structure is tested by component-level two-coloring and an intra-set edge ratio

$7.63\%$7

Stack patterns are defined on bounded-length paths $7.63\%$8 subject to amount-preservation and inter-arrival constraints, specifically $7.63\%$9 and $10.19\%$0.

The stated computational profile reflects these choices. Sorting timestamped edges gives $10.19\%$1 preprocessing, count and sum aggregation is $10.19\%$2, bipartite two-coloring is linear in component size, and stack enumeration is worst-case exponential but is constrained in practice by $10.19\%$3, time-window limits, and pruning on amount similarity. This suggests that MPOCryptoML trades end-to-end differentiability for explicit structural control over laundering motifs.

4. Correlation modeling and anomaly ranking

After PPR, NTS, and NWS are computed on the visited-node set, MPOCryptoML fits a logistic regression model to the feature vector

$10.19\%$4

with binary label $10.19\%$5 when ground truth is available. The model is

$10.19\%$6

and its output is treated as a suspiciousness score

$10.19\%$7

The training setup uses an $10.19\%$8 train/validation/test split, $10.19\%$9 regularization, the liblinear solver, max_iter=1000, and class_weight="balanced" or stratified sampling for class imbalance (Samadi et al., 18 Aug 2025).

The final anomaly-ranking stage integrates diffusion and correlation analysis through the score

$$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$0

The model description states that the reported experiments use this ratio. The accompanying interpretation is that the ratio emphasizes nodes with disproportionately large PPR relative to the logistic-regression suspiciousness estimate, thereby highlighting random-flow anomalies that may not be fully explained by the low-dimensional pattern features alone.

This scoring design makes the architecture modular. Multi-source PPR captures diffuse connectivity from risky seeds; NTS and NWS summarize temporal and volumetric asymmetry; logistic regression estimates how those asymmetries correlate with labeled anomalies; the final ratio fuses both views into a ranking. A common misconception is to read MPOCryptoML as a pure classifier over node attributes. In the reported system, the ranking is explicitly a composite of graph diffusion, handcrafted motif signals, and supervised calibration rather than a single end-to-end learned embedding model.

5. Experimental evaluation

The reported evaluation uses three public datasets, all converted to graph form for anomaly ranking. Elliptic++ contains $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$1 nodes, $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$2 edges, $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$3 node features, $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$4 anomalies, and average degree $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$5. The Ethereum Fraud Detection dataset contains $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$6 nodes, $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$7 edges, $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$8 node features, $$\{\text{sender}, \text{receiver}, \text{amount}, \text{timestamp}, \text{optional metadata}\}$$9 anomalies, and average degree $V$0. The Wormhole dataset contains $V$1 nodes, $V$2 edges, $V$3 node features, $V$4 anomalies, and average degree $V$5. The implementation environment is Python with PyTorch and scikit-learn on AWS EC2 g4dn.2xlarge, using one NVIDIA T4 and $V$6 GiB RAM; the sensitivity study selects $V$7 for PPR from $V$8, with $V$9 in the reported PPR weights because temporal effects are handled by NTS (Samadi et al., 18 Aug 2025).

Dataset	Graph statistics	MPOCryptoML results
Elliptic++	203,769 nodes; 234,555 edges; 4,545 anomalies	Precision@K 95.43%; Recall@K 94.23%; F1 94.51%; Accuracy 95.41%; AUC 94.21%
Ethereum	9,816 nodes; 9,265 edges; 2,179 anomalies	Precision@K 97.39%; Recall@K 96.16%; F1 96.48%; Accuracy 97.39%; AUC 97.40%
Wormhole	219,581 nodes; 236,295 edges; 158 anomalies	Precision@K 92.55%; Recall@K 91.11%; F1 90.89%; Accuracy 92.57%; AUC 93.75%

The baseline set comprises XGBoost, DeepFD, OCGTL, ComGA, FlowScope, GUDI, and MACE. Against these baselines, the reported gains reach up to $E$0 in precision, up to $E$1 in recall, up to $E$2 in F1-score, and up to $E$3 in accuracy. The ablation study is especially diagnostic: using only normalized timestamp and weight features yields accuracy $E$4 on Ethereum, $E$5 on Elliptic++, and $E$6 on Wormhole; using only the random cryptoML PPR component yields $E$7, $E$8, and $E$9, respectively; the full MPOCryptoML model yields $W$0, $W$1, and $W$2. This indicates that the reported performance depends on combining diffusion with explicit multi-pattern statistics rather than on any single module.

6. Relation to neighboring research, misconceptions, and limitations

Within graph-based cryptocurrency AML, MPOCryptoML is positioned against single-pattern detectors, rule-based systems, and GNN-style baselines. Its distinguishing move is to decompose laundering behavior into multiple motif families and to operationalize those families through separate modules for diffusion, temporal asymmetry, and transaction-volume imbalance. This suggests an architectural preference for structured feature design over latent embedding alone (Samadi et al., 18 Aug 2025).

A separate terminological issue arises because “CryptoML” in arXiv literature often denotes privacy-preserving machine learning under MPC or HE. Examples in the same literature include MPClan for honest-majority multiparty ML computation (Koti et al., 2022), CrypTFlow for secure medical-image inference (Alvarez-Valle et al., 2020), CrypTorch for compiler-driven MPC approximation tuning (Liu et al., 24 Nov 2025), Ironman for near-memory OT acceleration in PPML (Lin et al., 22 Jul 2025), and Power-Softmax for HE-friendly polynomial LLM inference (Zimerman et al., 2024). MPOCryptoML is distinct from those systems: it is an AML transaction-graph detector for off-chain cryptocurrency activity rather than a secure-computation runtime or encrypted-inference framework.

The limitations stated for MPOCryptoML are operational rather than cryptographic. Legitimate high-throughput services such as exchanges and payment processors can produce false positives because fan-in and fan-out patterns also occur in ordinary custodial workflows. The model is sensitive to the choice of $W$3, $W$4, $W$5, and the latency thresholds; overly tight values can miss slow layering, whereas loose values can overflag routine activity. Mixers, tumblers, CoinJoin, dust attacks, and smart-contract-based obfuscation can disrupt degree- and amount-based heuristics. Off-chain visibility is inherently partial, so incomplete subgraph reconstruction can propagate seed noise through PPR. The proposed future directions are to integrate GNNs as auxiliary modules, pursue semi-supervised learning with PU labeling, use adaptive thresholds through Bayesian optimization or reinforcement learning, and extend explainability through counterfactual subgraph generation (Samadi et al., 18 Aug 2025).

Taken together, these features place MPOCryptoML in a specific methodological niche: it is a graph-analytic, multi-pattern anomaly-ranking system for off-chain cryptocurrency laundering, built from interpretable structural detectors and validated on public transaction datasets, rather than a generic neural architecture or a privacy-preserving cryptographic ML stack.