Ethereum Transaction Knowledge Graph

• TKG is a multi-relational directed graph constructed from on-chain Ethereum transactions that encodes fund-flow and curated behavioral features.
• The methodology uses GNN-based message passing with masked co-attention to fuse expert features with transformer embeddings for robust link prediction.
• Joint pre-training and expert feature integration yield significant improvements in phishing detection and account de-anonymization tasks.

Searching arXiv for the cited papers to ground the article in current literature. A Transaction Knowledge Graph (TKG), in the formulation introduced in "KGBERT4Eth" (Jia et al., 4 Sep 2025), is a multi-relational directed graph over Ethereum addresses and transaction relations, designed to encode fund-flow structure together with expert-curated behavioral features. Within that framework, the TKG is one of two jointly trained components of a feature-complete encoder, the other being a Transaction LLM (TLM) operating over conceptualized transaction records. The TKG supplies structured representations of transaction modalities, latent transaction relationships, and node-level financial, temporal, and network-structural signals, and is integrated with the transformer stream through masked co-attention during pre-training (Jia et al., 4 Sep 2025).

1. Formal definition and representational scope

In KGBERT4Eth, the TKG is defined as a multi-relational directed graph

$G = (V, E),$

where $V$ is the set of entities, identified with Ethereum addresses, and $E \subseteq V \times R \times V$ is the set of labeled edges or triples $(h,r,t)$ (Jia et al., 4 Sep 2025). The node set comprises two account types: Externally Owned Accounts (EOA) and Contract Accounts (CA). The relation vocabulary contains two high-level transaction modalities: external_tx, denoting a direct Ether transfer from one address to another, and contract_tx, denoting a transfer or call that routes through a smart contract. Semantically, a triple $(h,r,t)$ means that entity $h$ engages in a transaction of type $r$ with entity $t$ (Jia et al., 4 Sep 2025).

Each node $v_i \in V$ is initialized with a real-valued feature vector $x_i \in \mathbb{R}^F$. These attributes span three categories. The first is financial statistics, including examples such as max/min/avg incoming/outgoing amounts, balance, and in/out ratio. The second is temporal activity, including account lifetime, active days, and short/long-term transfer frequencies. The third is network-structural metrics, including degree, betweenness, closeness, Katz and eigenvector centralities, and clustering coefficient (Jia et al., 4 Sep 2025).

This schema makes the TKG explicitly heterogeneous at both the edge and feature levels. A plausible implication is that the graph is intended to preserve distinctions that would be collapsed in purely sequence-based or purely embedding-based fraud detectors. In the paper’s terminology, this is part of the broader attempt to combine structured fund-flow patterns with human-curated feature insights (Jia et al., 4 Sep 2025).

2. Construction from on-chain transaction records

The graph construction process begins with node extraction from raw on-chain data. All distinct addresses appearing in the from, to, or contractAddress fields of transactions are collected into $V$0. Each address is then labeled as EOA or CA depending on whether it ever appears as a contractAddress (Jia et al., 4 Sep 2025).

Edge extraction is transaction-wise. For each transaction record $V$1, let $V$2 and $V$3. If $V$4 is empty, the graph adds the triple $V$5. Otherwise, when the record corresponds to a contract invocation, it adds $V$6 (Jia et al., 4 Sep 2025). The resulting edge set therefore distinguishes direct Ether transfers from contract-mediated interactions using only two relation types.

Feature computation proceeds over a historical window. Per-node statistics such as total numbers of incoming and outgoing transfers and transferred amounts are computed. Temporal indicators are then derived, with lifetime defined as

$V$7

and active days defined as the number of distinct days. A one-hop transaction graph is constructed to compute centrality and clustering metrics. These signals are concatenated to form the initial node embedding $V$8 (Jia et al., 4 Sep 2025).

The paper’s pseudocode summarizes this pipeline as follows: all unique addresses are inserted into $V$9; expert features $E \subseteq V \times R \times V$0 are computed for each node; an MLP maps these to initial node states $E \subseteq V \times R \times V$1; and the edge set $E \subseteq V \times R \times V$2 is populated by iterating over transactions and assigning either external_tx or contract_tx according to whether contractAddress is empty (Jia et al., 4 Sep 2025).

3. Embedding methodology and transaction link prediction

The TKG encoder is GNN-based. At layer $E \subseteq V \times R \times V$3, node embeddings $E \subseteq V \times R \times V$4 are updated by attention-weighted neighborhood aggregation:

$E \subseteq V \times R \times V$5

$E \subseteq V \times R \times V$6

where

$E \subseteq V \times R \times V$7

and

$E \subseteq V \times R \times V$8

Here $E \subseteq V \times R \times V$9 is the learned embedding of the relation label on edge $(h,r,t)$0, $(h,r,t)$1 are learnable linear maps, and $(h,r,t)$2 is a nonlinearity. The formulation also permits multi-head variants through repetition with separate parameter sets (Jia et al., 4 Sep 2025).

Pre-training on the graph uses a Transaction Link Prediction (TLP) objective. Let $(h,r,t)$3 be the set of positive triples $(h,r,t)$4, and let $(h,r,t)$5 be a set of negative, corrupted triples. Using a scoring function $(h,r,t)$6, with examples including TransE, RotatE, and DistMult, the loss is defined as

$(h,r,t)$7

where $(h,r,t)$8 is a margin and $(h,r,t)$9 is the sigmoid. The paper also gives a simplified notation:

$(h,r,t)$0

For graph pre-training in the full model, RotatE scoring is used by default (Jia et al., 4 Sep 2025).

This embedding design makes the TKG not merely a static store of engineered features, but a learnable relational encoder whose node representations are updated by message passing and supervised by link prediction. This suggests that latent transaction regularities are expected to emerge from both topological context and explicit relation labels.

4. Coupling with the transformer through mask-invariant attention synergy

The TKG is not trained in isolation. In KGBERT4Eth it is jointly optimized with a transformer-based TLM through a mask-invariant attention synergy module. At layer $(h,r,t)$1, the transformer provides semantic embeddings

$(h,r,t)$2

while the graph encoder provides entity embeddings

$(h,r,t)$3

The co-attention update from semantics to graph restricts cross-attention so that only the $(h,r,t)$4 position can attend to $(h,r,t)$5, implemented by a visibility mask

$(h,r,t)$6

The attention weights are

$(h,r,t)$7

and the attended representation is

$(h,r,t)$8

In practice, only $(h,r,t)$9 receives non-masked attention; all other tokens remain unchanged (Jia et al., 4 Sep 2025).

The update is symmetric in the reverse direction. Treating $h$0 as queries, graph embeddings are allowed to attend only to $h$1:

$h$2

$h$3

The fused outputs are integrated by residual feed-forward updates and layer normalization:

$h$4

with each $h$5 updated analogously (Jia et al., 4 Sep 2025).

A notable design decision is that no extra coordination loss is introduced; the two streams influence each other purely through this masked co-attention. Within the paper’s framework, the TKG therefore contributes to representation fusion indirectly through layerwise interaction rather than through a separate alignment objective.

5. Joint pre-training objectives, algorithmic workflow, and operational scale

The transformer stream is pre-trained with Biased Masked Prediction (BMP). For each account’s transaction text $h$6, BM25 scores are computed per token. A token $h$7 is masked if

$h$8

with $h$9, and standard MLM cross-entropy is applied only over selected tokens:

$r$0

The graph stream is trained with the TLP objective described above, and the combined loss is

$r$1

The paper states that the biased masking task is designed to emphasize rare anomalous transactions by focusing on statistical outliers (Jia et al., 4 Sep 2025).

The joint pre-training loop alternates between transformer forward propagation over masked transaction text, GNN propagation over sampled account subgraphs, application of the mask-invariant attention synergy module, and accumulation of $r$2 and $r$3. Parameters of both encoders are then updated jointly by back-propagation. In the provided pseudocode, a batch of accounts $r$4 and their subgraphs $r$5 are sampled; token embeddings are processed through transformer layers; node embeddings are processed through GNN layers; the MiAS module fuses the streams; and losses are accumulated before an optimizer step (Jia et al., 4 Sep 2025).

The operational scale reported for pre-training is a corpus of 3.25 M transactions, yielding approximately 500 k nodes and 1 M edges. The transformer backbone is BERT-base (12 layers, $r$6) with maximum sequence length $r$7. The mask threshold is $r$8 using the BM25L variant. The number of GNN layers is not explicitly fixed, though 2–3 are described as typical experimentally. At fine-tuning time, subgraph sampling uses a 2-hop neighborhood with $r$9 nodes. Optimization uses the Adam optimizer (standard BERT settings) with learning rate approximately $t$0 and total steps approximately 100 k (Jia et al., 4 Sep 2025).

6. Role in Ethereum fraud detection and relation to broader TKG literature

Within KGBERT4Eth, the TKG is one component of a feature-complete encoder for multi-task Ethereum fraud detection. The paper states that existing detection mechanisms bifurcate into three technical strands: expert-defined features, graph embeddings, and sequential transaction patterns, and argues that the absence of cross-paradigm integration mechanisms forces practitioners to trade off among sequential context awareness, structured fund-flow patterns, and human-curated feature insights. The TKG is introduced specifically to incorporate expert-curated domain knowledge into graph node embeddings so as to capture fund-flow patterns and human-curated feature insights, while the TLM captures contextual semantic representations from conceptualized transaction records (Jia et al., 4 Sep 2025).

Empirically, KGBERT4Eth is reported to significantly outperform state-of-the-art baselines in both phishing account detection and de-anonymization tasks, with absolute F1-score improvements of 8–16% on three phishing detection benchmarks and 6–26% on four de-anonymization datasets (Jia et al., 4 Sep 2025). Because the model is defined as jointly optimizing the TLM and TKG pre-training objectives, these improvements are attributed at the system level rather than to the graph component alone.

A common source of terminological ambiguity is that TKG is also widely used to denote Temporal Knowledge Graph in the knowledge graph forecasting and completion literature. In that literature, a TKG is a set of timestamped quadruples $t$1 or, equivalently, a sequence of graph snapshots $t$2, and typical tasks involve forecasting future facts or completing missing entities under temporal constraints (Lee et al., 2023). T-GAP, for example, defines a Temporal Knowledge Graph as a set of time-annotated facts $t$3 and studies query answering of the form $t$4 באמצעות displacement-aware temporal GNN encoding and path-based attention flow (Jung et al., 2020). HyperVC likewise treats a TKG as a sequence of graph snapshots and models chronological hierarchies autoregressively in hyperbolic space with variable curvature (Sohn et al., 2022).

This dual usage does not indicate conceptual identity between the two notions. In KGBERT4Eth, the TKG is a transaction-centric, feature-augmented relational graph over Ethereum accounts; in the temporal KG literature, the graph is defined primarily through timestamped facts and forecasting or completion objectives. A plausible implication is that the acronym alone is insufficiently specific in cross-domain discussion, especially when blockchain transaction graphs and temporal knowledge graphs are both under consideration.