Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study

arXiv:2501.18158 · cs.CR, cs.LG · Submitted 2025-01-30 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Large Language Models for Cryptocurrency Transaction Analysis".

Elias: Large language models (LLMs) have been applied to analyze cryptocurrency transaction graphs,

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So, we're talking about this paper now titled "Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study." It seems the main idea is that we need better ways to look at transaction graphs because the current black-box models are hard to understand. Elias, what’s the core thesis here?

Elias: Well, Nadia, it claims that large language models have the potential to fill those gaps by analyzing real-world cryptocurrency transaction graphs, specifically Bitcoin networks. They test this hypothesis by setting up a three-tiered framework for measuring how well these LLMs can actually understand the data.

Priya: From my side, I’m curious what kind of understanding they are aiming for; is it just basic counting, or something deeper into the actual behavior of these transactions? I want to know if this study actually shows anything meaningful about the data itself.

Nadia: Exactly, Priya. The paper lays out this three-tiered framework: foundational metrics, characteristic overview, and contextual interpretation. It sets out to systematically measure the LLMs' capabilities across all those levels using Bitcoin transaction graphs as their test case for cybercrime detection research.

Elias: That framework is supported by two main innovations they introduce to handle the token constraints that usually bog down LLM analysis of large graphs. They propose a new text-based graph representation format called LLM4TG, which is designed to be human-readable and reduce redundant data.

Priya: Reducing data redundancy sounds useful for managing those massive datasets, but how does this new format actually help the analysis process when you're trying to extract meaningful patterns from financial activity? I need to know what the practical benefit of LLM4TG is for interpreting these transaction flows.

Nadia: The paper suggests that by using LLM4TG alongside another technique called CETraS, they can significantly reduce the token requirements needed to process these moderately large-scale Bitcoin graphs, making the analysis feasible where it was previously nearly impossible under strict token limits.

Elias: That CETraS algorithm is designed to condense those mid-sized transaction graphs while keeping the essential structures intact by assigning an "Inode" importance metric based on things like in/out degrees and token amounts. Lower importance nodes get eliminated first, which helps manage the graph size efficiently.

Priya: So, if they're condensing the graph this way, what does that mean for Priya’s work on privacy? Are we losing any subtle transaction details when they prioritize eliminating lower-importance nodes to fit the LLM into its processing window?

Nadia: The paper shows that when you measure these LLMs against the three levels of understanding, foundational metrics and characteristic overview show very strong performance, with accuracy for most basic node metrics exceeding ninety-eight point five zero percent.

Paper summary: Elias: That foundational metric success is impressive, but we have to look at the other levels too; they also test for a characteristic overview where LLMs can spot highlighted traits like a significantly large out-degree of a node. In that area, GPT-4o demonstrated substantially higher response quality than GPT-four achieving ninety-five point zero zero percent meaningful outputs in ninety-five point zero zero percent of cases.

Priya: That's promising for spotting anomalies, but what about the third level, contextual interpretation? The paper says this tests classification tasks even with very limited labeled data, and their top-three accuracy reached seventy-two point four three percent, though they note that the explanations aren't always fully accurate. What does that level of interpretation actually tell us about identifying malicious activity?

Nadia: That third level is where we really get to the behavioral patterns, Priya; it assesses the LLMs' ability to perform classification tasks within cryptocurrency networks, which directly relates to cybercrime detection. The study used datasets like BASD and BABD derived from Bitcoin transactions for these tests.

Elias: Interestingly, while they show consistent strength in node metrics across the board, the results reveal that performance on global metrics is noticeably weaker, particularly when those tasks require difference calculations between nodes. That tells us where the current LLM analysis falls short when it tries to grasp broader network dynamics.

Priya: So, to summarize what I'm hearing about these findings from "Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study," it seems the paper establishes that LLMs are quite good at understanding local node details and general characteristics of the graph, but they struggle more when trying to calculate complex relationships between different parts of the network.

Nadia: That points toward a specific application area where we might need more specialized tools, Priya. The paper introduces this layered framework—the three levels—and the tools LLM4TG and CETraS are designed to make processing these large graphs manageable for AI analysis, which is exciting for security research.

Elias: I think the real contribution lies in presenting that layered framework alongside those specific structural solutions, LLM4TG and CETraS. It shows a structured way to approach applying LLMs to this domain rather than just throwing an LLM at a raw graph without any pre-processing.

Priya: For the impact on the world, I see this as laying down a baseline for how much we can trust an AI's analysis of financial networks, but the limitation mentioned is that existing research mostly focuses on knowledge graphs or randomly generated graphs, and they flag that common formats like GEXF and GraphML aren't ideally suited for LLMs because of those space constraints.

Nadia: That limitation is crucial; it means the paper’s success is heavily dependent on their custom format, LLM4TG, to overcome the inherent limitations of standard graph representations when feeding them into an AI. It suggests that future work needs to focus heavily on developing formats specifically engineered for LLM input efficiency.

Paper summary: Elias: Exactly, and they also pointed out that the effect of using engineered graph features remains insufficiently studied in this context, which is a clear direction for future cryptographic analysis research. They've shown the potential for inferring motivations in transaction patterns, which could be very useful down the road.

Priya: So it seems the core idea here is that LLMs can help us start identifying anomalous transaction patterns and inferring motivations in security-critical contexts, even if their explanations aren't always fully accurate at the highest level of interpretation. That’s a realistic view for a system we're hoping to deploy.

Nadia: It really shows the potential for LLMs to provide interpretable reasoning processes when looking at transaction networks, which is something security researchers have been pushing for. The paper sets a solid foundation by demonstrating these capabilities across metrics, overview, and interpretation using Bitcoin data.

Elias: That foundation is important because it proves that LLMs can handle the basic structure of the data effectively if you give them a sensible input structure via LLM4TG and CETraS. It moves the conversation past just testing raw models to testing how we engineer the input for them.

Priya: I think what this means for privacy research is that we have a new benchmark—the three-tiered framework—that other researchers can use to compare different AI approaches when they look at sensitive financial data, giving us a standardized way to measure their performance on real-world transaction graphs.

Nadia: So we’ve got the paper’s name, the authors, and this framework that tests LLMs across three levels of understanding using Bitcoin transactions as the subject. This work really establishes a solid foundation for applying LLMs to cryptocurrency analysis by showing their effectiveness at capturing local node details and broader behavioral patterns.

Elias: That is pretty much what we've covered regarding the paper itself, Nadia; it lays out that LLM4TG and CETraS enable efficient analysis of large Bitcoin graphs, successfully measuring the capacity of LLMs to capture both local node details and broader behavioral patterns in transaction networks.

Priya: Ultimately, this research highlights the significant potential of LLMs for identifying anomalous transaction patterns and providing interpretable reasoning processes in security-critical contexts, even while acknowledging that token limits restrict the amount of graph data that can be processed at once.

Nadia: It’s exciting to think about how we can use these methods to uncover hidden anomalies or infer motivations in transaction flows, which is exactly what we want when looking at security-critical contexts. The paper definitely sets a direction for where this research needs to go next, especially concerning those token limitations.

Conclusion: Nadia: So we've been walking through how these large language models can actually digest complex Bitcoin transaction graphs using their new framework, LLM4TG and CETraS, which is really showing us a lot about what's possible right now. Elias, let's wrap up by talking about the title and the authors of this paper: "Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study."

Elias: Yeah, I think focusing on the Bitcoin case study is important because it grounds this whole AI capability in a real-world financial network structure; the authors chose that specific dataset to really test those metrics we talked about.

Priya: I agree, and what really stands out from their conclusion is how they frame this as a measurable assessment of an AI's understanding, which is crucial for us measuring privacy impacts.

Nadia: Exactly; the implications are that we can start thinking about how much trust we can place in AI when it analyzes these specific types of transaction patterns, especially concerning potential security threats.

Elias: From a cryptographic standpoint, the paper suggests that these models are good at capturing local node details, which is a strong starting point for inferring things like transaction motivations within the network.

Priya: That's where I see the real data showing up; it demonstrates that an AI can identify certain characteristics of a graph with high accuracy before we even get to the deeper interpretation phase.

Nadia: It really opens up avenues for us to explore how these models could be used, maybe in detecting subtle anomalies that traditional methods might miss when looking at large transaction flows.

Elias: And while they show potential for this kind of analysis, we have to keep in mind the limitations they pointed out regarding the token constraints and the accuracy issues in contextual interpretation.

Priya: Those limitations are vital because it sets a clear benchmark for where these AI tools are currently reliable when we look at real, sensitive data.

Nadia: So, this work gives us a solid starting point for figuring out how these models perform on Bitcoin data, and it makes me wonder who can actually exploit these insights in a real-world scenario.

Monash University

cs.CR, cs.LG

Submitted: 2025-01-30

Updated: 2026-10-06

Code: https://github.com/yuchen-lei/llm4tg

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 85/100

The gist: Large language models (LLMs) have been applied to analyze cryptocurrency transaction graphs, and this study tests their capabilities in cybercrime detection by introducing a three-tiered framework

Key concepts

LLM4TG: This is a new text-based format for representing graphs that makes them easy for LLMs to understand. It organizes nodes into layers based on whether they are an 'address' or a 'transaction.' This structure helps reduce redundant data and fits better within the limited processing capacity of AI models.
CETraS: This is a sampling algorithm designed to shrink large transaction graphs while keeping the most important parts. It calculates an 'Inode' score for each node based on its connections and token amounts. Nodes with lower scores are removed first, ensuring the essential structure and paths remain intact for analysis.
Foundational Metrics: This level measures an LLM's ability to read basic information about individual nodes in the graph, such as their in-degree (incoming connections) and output token amount. LLMs perform very well here, achieving high accuracy because these are straightforward data points readily available for analysis.
Contextual Interpretation: This is the highest level of understanding where an LLM must perform complex tasks like classification using very little labeled data. While performance is lower than basic metrics, it shows the potential for LLMs to infer broader behavioral patterns and classify transaction types, even when information is scarce.

Terminology

Accuracy — 43× in this paper · explained in 1 episode
Nadia — 16× in this paper · explained in 2 episodes
Elias — 14× in this paper · explained in 2 episodes
F1 Score — 12× in this paper · explained in 2 episodes
Large Language Models (LLMs) — 6× in this paper · explained in 5 episodes
Knowledge Graph — 5× in this paper · explained in 7 episodes
Knowledge graphs — 5× in this paper · explained in 2 episodes
Benchmark — 4× in this paper · explained in 2 episodes
Interpretability — 4× in this paper · explained in 15 episodes
Redundancy — 4× in this paper · explained in 2 episodes
Knowledge Discovery and Data Mining — 3× in this paper
Computer and Communications Security — 2× in this paper
Consistency — 2× in this paper · explained in 3 episodes
Core — 2× in this paper · explained in 2 episodes
Fidelity — 2× in this paper · explained in 2 episodes
GNNs — 2× in this paper · explained in 2 episodes
Structural Integrity — 2× in this paper · explained in 3 episodes
Transformer — 2× in this paper · explained in 2 episodes
Adaptability — 1× in this paper · explained in 1 episode
Benchmarking — 1× in this paper · explained in 3 episodes
Chain-of-Thought Prompting — 1× in this paper · explained in 2 episodes
Fine-Tuning — 1× in this paper · explained in 5 episodes
Generative Pre-trained Transformer — 1× in this paper
Prompt Engineering — 1× in this paper · explained in 4 episodes
Trace — 1× in this paper · explained in 2 episodes

Summary

Large language models (LLMs) have been applied to analyze cryptocurrency transaction graphs, and this study tests their capabilities in cybercrime detection by introducing a three-tiered framework involving a human-readable graph representation format (LLM4TG), a connectivity-enhanced sampling algorithm (CETraS), and three levels of understanding: foundational metrics, characteristic overview, and contextual interpretation.

The gist: LLMs have outstanding performance on foundational metrics and characteristic overview, where the accuracy of recognizing most basic information at the node level exceeds 98.50% and the proportion of obtaining meaningful characteristics reaches 95.00%.

Framework for Analysis

The research introduces a three-tiered framework to assess LLM capabilities: foundational metrics, characteristic overview, and contextual interpretation. This framework is supported by two key innovations designed to handle the token limitations of LLMs when processing large transaction graphs. The first innovation is LLM4TG, a new text-based graph representation format designed to reduce redundant data and provides a human-readable syntax that naturally supports processing by LLMs. This format organizes nodes into layers based on their type (address or transaction), which helps in preserving the original structure while efficiently utilizing the limited token budget.

Graph Simplification and Representation

To manage the size of moderately large-scale transaction graphs, the paper proposes a Connectivity-Enhanced Transaction Graph Sampling algorithm, CETraS. This algorithm is designed to condense mid-sized transaction graphs while maintaining essential structures by establishing a metric of importance for each node (Inode) calculated using formulas involving in/out degrees and token amounts. Nodes with lower importance are prioritized for elimination, and paths connecting retained nodes are preserved to ensure connectivity. The combination of LLM4TG and CETraS significantly reduce[s] token requirements, transforming the analysis of multiple moderately large-scale transaction graphs with LLMs from nearly impossible to feasible under strict token limits.

Three Levels of Understanding

The study defines three levels for measuring the understanding of a transaction graph by an LLM:

Foundational Metrics: This level assesses the ability to determine the basic information of the graph such as the in-degree and output token amount of a node. Results show that LLMs excel here, with accuracy for most metrics between 98.50% and 100.00% on node metrics.
Characteristic Overview: This level tests if LLMs can figure out the highlighted characteristics of the graph, e.g., a node has a significantly large out-degree. GPT-4o demonstrated substantially higher response quality in this level compared to GPT-4, achieving 95.00% meaningful outputs in 95.00% of cases.
Contextual Interpretation: This highest level evaluates the LLMs' ability to perform classification tasks, even with very limited labeled data. Top-3 accuracy reached 72.43%, highlighting their potential in classification tasks, although explanations are noted as not always fully accurate.

Experimental Setup and Findings

Experiments were conducted using two datasets derived from the Bitcoin transaction graph: BASD and BABD. Five LLMs—GPT-3.5, GPT-4, GPT-4o, DeepSeek v3, and LLaMA 3.3—were selected for evaluation across various tasks. The analysis revealed that LLMs show consistently strong performance in node metrics, but performance on global metrics is noticeably weaker, especially for those requiring difference calculations. In contextual interpretation, GPT-4o consistently achieved the highest recall (47.45%) and macro precision (39.84%), suggesting greater consistency across categories compared to other models.

Key Contributions and Limitations

The primary contributions include presenting the layered framework with three levels of understanding, proposing the LLM4TG format, and designing the CETraS algorithm. However, several limitations persist: existing research mainly focuses on knowledge graphs, common graph formats are not ideally suited for LLMs due to space constraints, and the effect of using engineered graph features remains insufficiently studied. Furthermore, while LLMs show potential in exploratory analysis and hypothesis generation, improving the reliability of their generated explanations remains a major challenge for high-stakes applications. Additionally, Token Limits restrict the amount of graph data that can be processed at once.

Conclusion

The work establishes a foundation for applying LLMs to cryptocurrency analysis by demonstrating their effectiveness across three distinct levels of graph understanding. The findings confirm that LLM4TG and CETraS enable efficient analysis of large Bitcoin graphs, and the framework successfully measures the capacity of LLMs to capture both local node details and broader behavioral patterns in transaction networks. This research highlights the significant potential of LLMs for identifying anomalous transaction patterns, inferring motivations, and providing interpretable reasoning processes in security-critical contexts.

Improvements for AI systems

As a fastidious and diligent AI researcher, I have analyzed the provided paper, Large Language Models for Cryptocurrency Transaction Analysis: A Bitcoin Case Study. The core contribution is a three-tiered framework (Foundational Metrics, Characteristic Overview, Contextual Interpretation) coupled with two key innovations: the LLM4TG text-based graph representation format and the CETraS connectivity-enhanced sampling algorithm.

Here are the specific improvements I propose for AI systems based on this research:

)

The proposed framework allows AI systems to move beyond simple pattern matching to a structured, multi-level understanding of complex, large-scale transaction graphs (like Bitcoin networks). The improved system will be capable of performing both low-level data extraction and high-level behavioral inference.
The LLM4TG representation format significantly reduces the token overhead associated with feeding raw graph data into LLMs. This allows AI systems to process moderately large transaction graphs efficiently, overcoming the severe input limitations of current models (like GPT-4o's token limits) which would otherwise render deep graph analysis infeasible.
The CETraS algorithm enables AI systems to intelligently sample and condense massive transaction graphs while preserving critical structural information and connectivity. The improved system will be able to summarize vast datasets—containing thousands of nodes—into a manageable, high-fidelity representation suitable for LLM processing, preventing context loss common in naive sampling methods.
The three-tiered measurement framework provides a standardized, quantifiable way to assess the capabilities of various Large Language Models (GPT-3.5, GPT-4o, DeepSeek). This allows researchers to select the optimal LLM architecture (e.g., GPT-4o for high characteristic overview accuracy) for specific analysis tasks (e.g., using it for classification vs. using a smaller model for foundational metrics).
The system can perform highly accurate local feature extraction on nodes, such as identifying exact in/out-degrees and values (Level 1 metrics), achieving over 98% accuracy. This enables precise identification of specific addresses or transactions based on their immediate neighborhood statistics within the graph structure.
The system can identify significant structural characteristics of a network, such as recognizing nodes with exceptionally high out-degrees or analyzing value discrepancies between in/out flows (Level 2 metrics). This allows the AI to flag potential hotspots or highly active entities within a transaction graph that warrant deeper investigation.
The system can perform zero-shot or few-shot classification of cryptocurrency addresses based on structural features (Level 3, Feature-based) and raw graph structures (Level 3, Raw Graph-based). This enables the AI to classify an unlabeled address into categories like 'Ponzi,' 'Gambling,' or 'Darknet Market' by synthesizing complex relational patterns.
The system can generate interpretable Chain of Thought style explanations for its classifications, detailing precisely which graph features (like high density or specific degree ratios) led to a particular conclusion. This moves the AI from being a black-box predictor to an explainable analytical tool, providing necessary evidence for security analysis and law enforcement purposes.
The system can perform cross-format evaluation of data representation, quantifying exactly how much accuracy is lost or gained when using GEXF vs. LLM4TG formats for foundational metrics. This allows researchers to select the most computationally efficient and accurate data structure for a given analytical goal, optimizing the trade-off between speed and fidelity.
The AI system can be deployed as a robust tool for cybercrime detection, specifically assisting in anti-money laundering (AML) by inferring suspicious transaction motivations based on contextual interpretation (Level 3), such as detecting patterns indicative of money laundering or Ponzi schemes, even with limited labeled data.