Descriptors of potentially fraudulent bitcoin transactions

Question

I'm looking into suspicious bitcoin transactional patterns and I was wondering whether there is someone with experience in that area.

If we consider transactions as iid data, then what descriptors (aka variables, statistics) would we investigate to infer not fraud - as fraud is a judicial decision - but suspicion?

Without KYC (Know-Your-Customer), it's a tough problem to tackle. KYC provides context according to which a transaction may be totally acceptable. However, without context, the same transaction may be perceived as suspicious, which further means that the inference system relies on guesswork.

Answer 1

In terms of blockchain data there is very little that may be of use to identify transactions sent to or by fraudsters. Bitcoin is pseudonymous and makes no judgment on the ethics of the human with the private key behind the address. There are some privacy leaks when transactions are broadcast: a certain configuration of multisig (k-of-n) or opting into RBF (nSequence field) may leak information on the user and the wallet they are using to construct the transaction. But generally the blockchain leaks very little. Most of the privacy leaks occur external to the blockchain e.g. when putting an address into a blockchain explorer from a certain IP address or sending Bitcoin to a KYC exchange from a particular Bitcoin address. If you log what Bitcoin address(es) a fraudster is requesting payments to you can obviously scan the blockchain to see how many payments were sent and the aggregate size of the payments. But the blockchain generally won't help you identify the fraudster's addresses in the first place.