{"id":"cc5b61bf-de54-424b-841b-c724df6bb4d8","arxiv_id":"2509.07392","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":10,"one_line_summary":"A GCN-GRU hybrid achieved 0.9807 AUC-ROC on Bitcoin mixing transaction detection, reportedly outperforming all baselines, though evidence lacks error bars and the graph is a feature-similarity graph rather than the transaction network.","lead":"A hybrid GCN-GRU model reports 0.9470 accuracy and 0.9807 AUC for detecting mixing-related Bitcoin transactions on a Wasabi Wallet dataset from 2020 to 2024. The result is presented as an improvement over Random Forest, GCN, CNN, and GRU baselines.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 3's neural rows all have Accuracy=Recall exactly; under the paper's own metric definitions this is only credible with an undocumented ~50% positive test rate, so the reported outperformance cannot be trusted until metrics are recomputed.","rationale":"The reader's weakest_assumption concerns the GCN graph construction; I agree that is a serious attribution problem. But the metric anomaly is more load-bearing because it attacks the numbers themselves: no graph correction can rescue a claim built on a table whose columns are internally inconsistent. The equality of Accuracy and Recall across every deep model, with Random Forest the exception, is exactly the signature of a recall=accuracy assignment in evaluation code. The implied test positive fraction (~0.5) is not documented anywhere, while the paper's own class counts give 0.178. The proposed check is straightforward and non-destructive: recompute from raw predictions or confusion matrices. Since both the metric issue and the graph issue support the reader's REJECT, I would leave the verdict unchanged. I partially agree with the reader: the rejection follows, but via a different load-bearing weakness.","tokens_in":8261,"tokens_out":11903,"duration_ms":132523,"concrete_test":"Have the authors release the per-model test confusion matrices or raw test predictions and recompute Table 3 with the formulas in §3.4. The decisive check is whether Recall is computed as TP/(TP+FN) or is accidentally set to Accuracy; the class balance of the sliding-window test set should be reported as well. If the recomputed Recall differs from the reported Recall for any row, the central performance claim collapses.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that GCN–GRU gives the best results (Acc=Recall=0.9470, AUC-ROC=0.9807)—rests entirely on Table 3. The table is internally unreliable: all five deep rows have Accuracy and Recall identical to four decimals, while Random Forest, evaluated without the 10-step sliding windows, has Acc=0.9343 versus Recall=0.6872. Under the definitions in §3.4, Accuracy=Recall implies TPR=TNR; combined with the reported Precision it implies a test-set positive fraction that is never reported. For GCN–GRU, Acc=Recall=0.9470 with Precision=0.9478 forces a positive fraction of about 0.50; the analogous calculation for GCN, CNN, GCN–CNN, and GRU gives ≈0.51–0.54. The stated full-data positive fraction is 69,031/(318,388+69,031)=0.178. Unless the 2023–2024 sliding-window test set is ~50% anomalous, these numbers cannot coexist; the most likely explanation is that the 'Recall' column actually contains Accuracy. If so, Table 3 is invalid and 'best across all metrics' is unsupported. This is independent of the separate, also serious problem that the GCN adjacency is a k-NN feature-correlation graph, not the transaction graph.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a hybrid GCN–GRU architecture for detecting anomalous (illicit) Bitcoin transactions in a Wasabi Wallet dataset spanning 2020–2024. The GCN is applied to a k-NN feature-correlation graph, and the GRU captures temporal dependencies over sliding windows. The authors report that GCN–GRU achieves the best overall results (Accuracy = 0.9470, Recall = 0.9470, AUC-ROC = 0.9807) compared with Random Forest, GCN, CNN, GCN–CNN, and GRU, and conclude that jointly modeling structural and temporal information improves anomaly detection.","tokens_in":8663,"tokens_out":3391,"duration_ms":40629,"significance":"If the reported results were reliable, the paper would provide a useful empirical comparison of graph–sequence hybrids for cryptocurrency anomaly detection, on a real and relatively recent dataset. However, the central claim rests entirely on Table 3, whose internal inconsistencies (Accuracy exactly equal to Recall for all five deep models) make the evaluation untrustworthy. The paper also frames the GCN as capturing transaction-network topology, while the actual adjacency is a feature-correlation graph, so the claimed 'structural' contribution is not what is described in the motivation. The absence of a described validation procedure further weakens confidence in the reported superiority. The topic is timely and the baseline comparison is broad, but the evidence as presented cannot support the paper's conclusions.","major_comments":[{"comment":"Accuracy equals Recall to four decimals for GCN, CNN, GCN–CNN, GRU, and GCN–GRU. Under the metric definitions in §3.4, Accuracy = Recall implies TPR = TNR. Combining that with the reported Precision forces a test-set positive fraction of approximately 0.50–0.54 (e.g., for GCN–GRU, p ≈ 0.504). The full-data positive fraction is 69,031 / (318,388 + 69,031) ≈ 0.178, and the test set is reported to be 2023–2024 but its class ratio is never given. Unless the test set is roughly balanced, these numbers cannot coexist. The most plausible explanation is that the 'Recall' column actually contains Accuracy, or there is a systematic metric-calculation error. Because the paper's central claim ('best across all metrics') relies wholly on this table, the evaluation is not credible as reported. The authors must recompute and report all metrics, and provide the test-set class distribution, error bars, a","section":"Table 3, §3.4"},{"comment":"The paper motivates the GCN as capturing structural dependencies of the 'Bitcoin transaction network,' yet the adjacency matrix is constructed as a k-NN graph over feature correlations (k=5, τ=0.2), not from the transaction graph. Thus the GCN component performs feature mixing on a similarity graph, and the reported improvement over GRU cannot be attributed to topological modeling of transaction flows. Either the graph should be built from actual transaction links (e.g., address or transaction hashes), or the claims about structural/topological learning must be revised and the feature-correlation graph justified as an appropriate structural proxy, with an ablation isolating its contribution.","section":"§3.3, §3.2, §1"},{"comment":"Hyperparameters (k, τ, window size T=10, hidden dimensions d_g=d_h=64, dropout, learning rate, batch size, max epochs) are fixed 'unless otherwise stated' without any described validation set or tuning protocol. Given the chronological train/test split (2020–2022 vs. 2023–2024), there is no evidence that these choices were not selected based on test-set performance. The paper should describe a validation procedure (e.g., chronological hold-out within training, early stopping on a validation split) and report sensitivity to the key hyperparameters, especially k and τ, which determine the graph structure.","section":"§3.3, §3.4"}],"minor_comments":[{"comment":"The reproducibility section states the dataset was provided by Kloint and mentions restrictions, but no dataset URL, access procedure, or preprocessing code is given. For a reproducibility-oriented claim, providing code and data-access details is important.","section":"§3.4 (Reproducibility)"},{"comment":"The description of the GCN–GRU pipeline is terse: it is unclear how the per-step GCN is applied (e.g., whether the adjacency is the same at every time step, whether node features are the transaction features at each time step, and how the sequence of GCN outputs is fed to the GRU). Figure 2 is referenced but the text is garbled and the figure is not included in the manuscript.","section":"§3.3 (Proposed Model Architecture)"},{"comment":"The hyperparameters for the CNN, GCN–CNN, and GRU baselines are only partially specified (e.g., number of layers, strides, pooling, recurrent layers). This limits reproducibility and direct comparison with the proposed model.","section":"Table 2"},{"comment":"There are several typographical and formatting issues, including 'sin ce' in §2.1, incomplete sentences around Figure 2, and inconsistent citation formatting (e.g., missing page numbers in [6], [8]). A thorough proofread is needed.","section":"General"}],"recommendation":"reject","confidential_remarks":"The accuracy-equals-recall pattern in Table 3 is a strong indicator of a metric transcription or computation error; if that were the only issue, a major revision could be considered. However, the feature-correlation graph problem and the lack of a validation protocol would still require substantial reworking of the method and evaluation. The paper's central claim is not supported by the evidence as presented, and I do not see a way to fix it within a standard revision cycle without recomputing all experiments and reframing the contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the headline performance claim doesn't survive contact with the paper's own table. In Table 3, Accuracy equals Recall exactly to four decimals for GCN, CNN, GCN-CNN, GRU, and GCN-GRU. Under the standard definitions the paper gives, that forces TPR=TNR, and combined with the reported Precision it implies a test-set positive rate around 50%. The full data has 17.8% positives. The paper never reports the test-set composition, so either the test set is extraordinarily different from the whole dataset or the Recall column is actually Accuracy. The second explanation is far more likely. That invalidates the central claim.\n\nWhat the paper does well: the data is real and non-trivial—Wasabi Wallet mixing transactions from 2020-2024, about 69k illicit and 318k normal. The baseline sweep is sensible and described clearly. The feature-correlation graph construction is transparent, and the authors are upfront about the dataset being proprietary.\n\nThe soft spots, in order: (1) the table inconsistency just mentioned; (2) the GCN adjacency is not the transaction graph promised in the intro. It is a k-NN graph over feature correlations. So the 'structural' component is feature mixing, not network topology, and the design rationale in Section 3.3 overstates it; (3) no error bars, no multiple seeds, no significance tests; (4) hyperparameters are fixed without a described validation split, which invites selection on the test set.\n\nI checked the stress-test arithmetic and it holds up. This is a reject-and-resubmit, not a desk reject. The dataset is valuable, and the flaws are fixable. A serious referee would catch the metric issue immediately, but the paper deserves that referee time. I'd want to see a corrected metrics table, multi-seed results, and a decision to either use the real transaction graph or drop the topology language.","headline":"Table 3's Accuracy=Recall coincidence invalidates the headline result; the Wasabi Wallet dataset is the real contribution, and the paper needs a corrected evaluation, not a desk reject.","tokens_in":9129,"tokens_out":4043,"would_cite":false,"duration_ms":42819,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A GCN-GRU hybrid that models both transaction structure and time sequences outperforms every baseline on Wasabi Wallet Bitcoin mixing data, reaching 0.9470 accuracy and 0.9807 AUC-ROC.","keywords":["cryptocurrency anomaly detection","graph convolutional network","gated recurrent unit","hybrid GCN-GRU","Bitcoin mixing transactions","illicit transaction detection","temporal graph learning","Wasabi Wallet dataset"],"falsifier":"Train the same GCN-GRU with the feature-correlation adjacency replaced by a random graph with the same degree distribution; if AUC-ROC remains about 0.98, the GCN branch is not contributing structural signal. The sharper test is to run the hybrid on the true address-to-address transaction graph and compare AUC-ROC with and without the GRU branch.","tokens_in":8171,"feed_emoji":"🔗","tokens_out":6465,"duration_ms":66816,"temperature":0.7,"pith_summary":"The paper sets out to show that detecting illicit Bitcoin transactions improves when a model looks at both the relational structure among transactions and their evolution over time. On four years of Wasabi Wallet mixing-transaction data, the proposed GCN-GRU hybrid reports Accuracy 0.9470, Recall 0.9470, and AUC-ROC 0.9807, better on every metric than Random Forest, GCN, CNN, GCN-CNN, and GRU under identical preprocessing. The authors read this as evidence that structural and temporal cues are complementary: GCN alone lags badly, while sequence models already do well, and the hybrid closes the remaining gap. The graph branch is worth scrutiny, because the adjacency matrix is built from feature correlations between transactions (k=5 nearest neighbors, threshold 0.2), not from the actual Bitcoin transaction links described in the introduction.","feed_headline":"GCN-GRU hybrid scores 0.98 AUC-ROC on Bitcoin mixing detection","feed_subtitle":"Modeling both graph structure and time sequences beats Random Forest, CNN, GCN, and GRU alone.","key_machinery":"The load-bearing object is a per-timestep GCN feeding a GRU. For node feature matrix X (N x F) and adjacency matrix A, the GCN layer computes H(l+1) = sigma(A_hat H(l) W(l)) with A_hat = D^{-1/2}(A+I)D^{-1/2}; the GRU then updates a hidden state with update gate z_t, reset gate r_t, and candidate state h_tilde_t, and the final hidden state h_T goes through a softmax output layer. Windows of length T=10 with stride 1 are used, with GCN hidden dimension 64, GRU hidden dimension 64, k=5 nearest neighbors for the graph, correlation threshold tau=0.2, and dropout 0.1. The intended work of the GCN branch is to encode structural context at each time step, while the GRU encodes how those contexts ev","core_discovery":"The central claim is that jointly modeling spatial and temporal dependencies outperforms either alone for anomaly detection in cryptocurrency transaction networks. The paper supports this with the GCN-GRU architecture: per transaction window, a graph convolutional layer transforms node features using a symmetrically normalized adjacency matrix with self-loops, and the resulting sequence of embeddings is fed into a GRU whose final hidden state is classified as normal or anomalous. On the Wasabi Wallet dataset (318,388 normal and 69,031 anomalous transactions, 2020-2024), the model achieves Accuracy 0.9470, Precision 0.9478, Recall 0.9470, F1-score 0.9474, and AUC-ROC 0.9807, the best overall","pith_inferences":["Because the adjacency matrix is a k-NN graph over feature correlations, the GCN branch may be doing feature mixing rather than encoding real transaction topology; testing the same architecture with a random graph or with true address-to-address edges would tell which interpretation the 0.9807 AUC-ROC supports.","The chronological split (train 2020-2022, test 2023-2024) means the numbers include temporal generalization; if mixer behavior shifts, the gap over GRU may shrink, so a natural stress test is to evaluate on each year separately.","Labeling each 10-step window by its final step means some windows contain mixed normal and anomalous steps; per-step anomaly localization would require a different evaluation than window-level accuracy.","The approach is a natural candidate for few-shot and online adaptation to new mixer types, since the paper identifies unseen fraud patterns as a limitation."],"forward_implications":["On the paper's own results, replacing a sequence-only GRU with the GCN-GRU hybrid lifts accuracy from 0.9360 to 0.9470 and AUC-ROC from 0.9786 to 0.9807, while keeping balanced precision and recall.","Using sliding windows with stride 1 means the model can produce a prediction for every new transaction in near real time, which the authors point toward for monitoring.","The same preprocessing and evaluation pipeline should transfer to other blockchain networks with labeled illicit activity, since the architecture only assumes node features and a graph.","The low recall of Random Forest (0.6872) versus hybrid recall (0.9470) suggests that ensemble tabular methods under-detect anomalies; the paper's comparison quantifies this gap."],"supporting_citations":[{"why":"Supplies the GCN layer formulation used by the proposed model.","marker":"[13]"},{"why":"Provides the GRU cell design used as the temporal encoder.","marker":"[14]"},{"why":"Prior hybrid GCN-GRU for blockchain fraud; the proposed architecture follows this line.","marker":"[12]"},{"why":"Shows GCNs improve Bitcoin fraud detection; supplies the graph-based fraud detection baseline.","marker":"[9]"},{"why":"Shows GRU with Random Forest improves fraud detection; supports the temporal modeling choice.","marker":"[10]"},{"why":"Unsupervised DBSCAN baseline with very low recall; motivates the supervised hybrid approach.","marker":"[8]"},{"why":"Hybrid temporal-structural models for blockchain anomaly detection; context for the combination.","marker":"[22]"}],"fun_headline_variants":["GCN-GRU hybrid tops Bitcoin anomaly detection","Hybrid model hits 0.98 AUC on Bitcoin transactions","Graph and sequence model beats baselines on Bitcoin","GCN-GRU sniffs out Bitcoin anomalies with 0.98 AUC","Joint graph-time network improves crypto fraud detection"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The model's graph is built from how similar transactions look in their feature values, not from who actually sent Bitcoin to whom; if those similarity links do not reflect the structure of laundering behavior, the hybrid's gain over a sequence-only model has nothing to do with network topology.","fun_headline_variants_meta":{"raw":{"variants":["GCN-GRU hybrid tops Bitcoin anomaly detection","Hybrid model hits 0.98 AUC on Bitcoin transactions","Graph and sequence model beats baselines on Bitcoin","GCN-GRU sniffs out Bitcoin anomalies with 0.98 AUC","Joint graph-time network improves crypto fraud detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000141,"raw_usage":{"total_tokens":927,"prompt_tokens":595,"completion_tokens":332,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":339,"completion_tokens_details":{"reasoning_tokens":253}},"tokens_in":339,"tokens_out":332,"duration_ms":4785,"temperature":1.0,"reasoning_tokens":253,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T22:17:45.458564+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same GCN-GRU with the feature-correlation adjacency replaced by a random graph with the same degree distribution; if AUC-ROC remains about 0.98, the GCN branch is not contributing structural signal. The sharper test is to run the hybrid on the true address-to-address transaction graph and compare AUC-ROC with and without the GRU branch.","supporting_citations":[{"cited_title":"Scientific Reports 15, 11076 (2025)","cited_arxiv_id":null,"evidence_quote":"Shows GCNs improve Bitcoin fraud detection; supplies the graph-based fraud detection baseline."},{"cited_title":"Transaction Fraud Detection Using GRU-centered Sandwich-structured Model","cited_arxiv_id":null,"evidence_quote":"Shows GRU with Random Forest improves fraud detection; supports the temporal modeling choice."},{"cited_title":"Journal of Current Research in Blockchain 1(1), 70 –90 (2024)","cited_arxiv_id":null,"evidence_quote":"Unsupervised DBSCAN baseline with very low recall; motivates the supervised hybrid approach."},{"cited_title":"In: Proceedings of the IEEE International Conference on Data Mining (ICDM), pp","cited_arxiv_id":null,"evidence_quote":"Hybrid temporal-structural models for blockchain anomaly detection; context for the combination."}],"review_version":1}