Illicit activity in cryptocurrency has increased dramatically over the years. Bitcoin mechanics allow for users to mask their identity through obfuscation techniques. Much research has been published in the domain of identifying illicit activity in cryptocurrency, and in particular the emergence of Graph Neural Networks (GNNs) has shown great promise in this area. In this paper, we propose two graph preprocessing methods to improve performance and robustness of our node classification GNN models in identifying illicit transactions in the Bitcoin network. Our methods focus on graph restructuring through measuring the connectivity of nodes in a graph, and the similarity of the underlying features each node possesses. We demonstrate the graph restructuring methodologies on five GNN architectures and empirically show an improvement of evaluation metrics when compared against the unprocessed graph dataset. We compare our proposed methods against other imbalanced node classification techniques on a common graph dataset. This methodology has great opportunity in the transaction monitoring landscape for exchanges and financial institutions attempting to capture potential illicit activity taking place on their networks including money laundering.

Identifying illicit behavior in the Bitcoin network is a well explored topic. The methods proposed over time have generated great insights into the deanonymization of the Bitcoin user base through the clustering of inputs and outputs. With advanced techniques being deployed by Bitcoin users, these heuristics are now being challenged in their ability to aid in the detection of illicit activity. In this SoK, we provide a comprehensive list of methods deployed by malicious actors on the network and illicit transaction mining methods. We highlight the issues associated with conducting law enforcement investigations and propose recommendations for the research community to address these issues. Our recommendations include the release of public data by exchanges to allow researchers and law enforcement to further protect the network from malicious users. We recommend the enhancement of current heuristics through machine learning methods and discuss how researchers can take the fight head-on against expert cyber criminals.