Research map / Vision-language and multimodal / Human and embodied modeling
BlockScan: Detecting Anomalies in Blockchain Transactions
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BlockScan, a BERT/RoBERTa-style masked language model with a custom multi-modal tokenizer, RoPE and FlashAttention, that flags blockchain transactions by masked-token reconstruction failure, evaluated on Ethereum and Solana DeFi transactions.
Problem
Detecting anomalous DeFi transactions (e.g., exploit-related) whose inputs mix blockchain hashes/addresses, large numbers, and log text; prior rule-based, traditional ML, and vanilla GPT-style approaches fail to model this structure well.
Approach
A customized MLM Transformer with a modality-specific tokenizer (frequent addresses as single tokens, numbers converted to hex and subword-tokenized, logs subword-tokenized), trained on benign transactions only; anomalies are scored by the fraction of masked tokens whose true token is not in the model's top-s predictions, with a theoretical domain-adaptation bound motivating the score.
Key results
- On Solana at k=10, BlockScan reaches 44.44% recall, 80% precision and 0.13% FPR, while Doc2Vec, GPT-4o and the heuristic get 0% recall; BlockGPT reaches 16.67% recall at k=10.
- On Ethereum at k=10, BlockScan reaches 80% recall, 80% precision and 0.28% FPR, versus BlockGPT's 70% recall and 70% precision at the same k.
- Replacing the custom tokenizer with the default BERT tokenizer drops Solana recall to 0% across all k; replacing RoPE with absolute embeddings lowers recall by roughly 20-30 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use BlockScan instead of BlockGPT | transaction anomaly detection · Solana, k=20 | Recall: 27.78% -> 72.22% | Helped |
| use BlockScan instead of BlockGPT | transaction anomaly detection · Ethereum, k=10 | Recall: 70% -> 80% | Helped |
| add the customized tokenizer rather than use default BERT WordPiece (ablation) | BlockScan · Solana | Recall: 0% -> 44.44% | Helped |
| encode log messages with subword tokenization rather than unique tokens (ablation) | BlockScan · Solana | Recall: 0% -> 44.44% | Helped |
| use RoPE rather than absolute positional embeddings (ablation) | BlockScan · Solana | Recall: 22.22% -> 44.44% | Helped |
| use the larger model rather than BERT-base (ablation) | BlockScan · Solana | Recall: 5.56% -> 44.44% | Helped |
| set detection mask ratio g=5 instead of the default g=15% (ablation) | BlockScan · Solana, k=10 | Recall: 44.44% -> 33.33% | Hurt |
| set detection mask ratio g=10 instead of the default g=15% (ablation) | BlockScan · Solana, k=10 | Recall: 44.44% -> 33.33% | Hurt |
| use one candidate token (s=1) rather than the default s=3 (ablation) | BlockScan · Solana, k=20 | Recall: 72.22% -> 77.78% | Helped |
| use five candidate tokens (s=5) rather than the default s=3 (ablation) | BlockScan · Solana, k=10 | Recall: 44.44% -> 44.44% | No clear effect |
| use FlashAttention (ablation) | BlockScan · Ethereum | Training time (s): 9,415 -> 7,042 | Helped |
| use FlashAttention (ablation) | BlockScan · Ethereum | GPU memory usage (GB): 78.4 -> 41.5 | Helped |
Surprising findings
- Fine-tuning GPT-4o via the OpenAI API gave no meaningful improvement over the base GPT-4o on Ethereum.
- Contrastive one-class learning with KDE scoring did not outperform the simple masked-prediction score.
Limitations
- Very small malicious test sets (10 Ethereum, 18 Solana transactions), so metrics are coarse and high-variance.
- Malicious transactions were manually verified and cross-checked, limiting dataset size.
- Tokenizer and model must be periodically rebuilt/retrained as transaction patterns evolve; adversaries mimicking benign patterns remain hard to detect.
Experimental setup
Datasets: Ethereum DeFi transactions (Oct 2020 to Apr 2023) Solana DeFi transactions (Sep to Dec 2023)
Benchmarks: Ethereum DeFi transaction anomaly set (10 malicious) Solana DeFi transaction anomaly set (18 malicious)
Metrics: FPR Recall Precision
Baselines: BlockGPT Doc2Vec + GMM GPT-4o Heuristic (sequence length)
Builds on: RoBERTa BlockGPT FlashAttention RoPE DeBERTa
Closest papers by meaning
- Multi-Chain Graphs of Graphs: A New Approach to Analyzing Blockchain Datasets (NeurIPS 2024 · similarity 0.83)
- The Temporal Graph of Bitcoin Transactions (NeurIPS 2025 · similarity 0.83)
- MTVHunter: Smart Contracts Vulnerability Detection Based on Multi-Teacher Knowledge Translation (AAAI 2025 · similarity 0.82)
- EVMbench: Evaluating AI Agents on Smart Contract Security (ICML 2026 · similarity 0.81)
- SCALM: Detecting Bad Practices in Smart Contracts Through LLMs (AAAI 2025 · similarity 0.81)
- EX-Graph: A Pioneering Dataset Bridging Ethereum and X (ICLR 2024 · similarity 0.80)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.