Advancing research and innovation for AI-supported action against illicit drug production and trafficking

The ARIEN Project is pleased to announce the publication of a new scientific article developed within the framework of the project entitled “Anomaly Detection in the Bitcoin Network Using a Semi-Supervised LSTM Autoencoder“.

The publication presents an artificial intelligence-based methodology for identifying anomalous behavioural patterns in the Bitcoin network that may be associated with illicit financial activities.

As cryptocurrencies become increasingly integrated into global financial systems, they also create new challenges for law enforcement authorities and financial investigators. Although transactions recorded on blockchain networks are publicly accessible, the pseudo-anonymous nature of cryptocurrency wallets can make it difficult to identify the individuals and criminal networks behind suspicious financial flows.

The research addresses this challenge by analysing how Bitcoin wallets behave over time and by identifying activity that significantly differs from patterns associated with legitimate use.

Analysing the temporal behaviour of Bitcoin wallets

The study proposes a semi-supervised Long Short-Term Memory Autoencoder, or LSTM-AE, designed to detect anomalies in sequences of Bitcoin wallet activity.

Long Short-Term Memory networks are particularly suitable for analysing time-dependent data because they can recognise behavioural patterns that develop across a sequence of transactions. In this context, the model examines the evolution of wallet activity rather than considering individual transactions in isolation.

The model is trained exclusively on data associated with licit behaviour. Through this process, it learns the temporal patterns that normally characterise legitimate Bitcoin wallet activity.

When the trained system subsequently analyses new wallet data, it measures how closely the observed behaviour corresponds to the patterns learned during training. Wallets displaying substantially different behaviour can therefore be identified as anomalous and prioritised for further examination.

This semi-supervised approach is particularly relevant in financial investigation contexts, where verified examples of legitimate behaviour are generally more widely available than complete and accurately labelled datasets of criminal activity.

Testing the model through the Elliptic++ dataset

The experiments were conducted using the Elliptic++ dataset, which contains information on Bitcoin transactions and wallet addresses, including data classified as licit or illicit.

Cryptocurrency datasets are often highly imbalanced, as the number of known illicit wallets represents only a small proportion of the overall network. This creates a significant challenge for conventional machine-learning models, which may achieve apparently high levels of accuracy while failing to detect the limited number of cases that are operationally relevant.

Despite this imbalance, the results of the study indicate that the proposed LSTM Autoencoder is capable of retrieving a large proportion of illicit wallets.

The findings demonstrate the potential value of temporal behavioural analysis as a supporting instrument for cryptocurrency investigations. Instead of relying exclusively on predefined criminal indicators, the methodology can help identify unusual behaviour that requires additional analytical or investigative attention.

The connection with the ARIEN project

The publication is closely connected with the objectives of ARIEN, which develops artificial intelligence-supported solutions to strengthen the monitoring, analysis and investigation of illicit drug production and trafficking.

Drug trafficking organisations increasingly operate through interconnected physical, digital and financial environments. Their activities may involve online marketplaces, encrypted communication platforms, social media, cryptocurrency payments and complex money-laundering mechanisms.

Understanding these financial dimensions is essential because cryptocurrency transactions can support different stages of the criminal process, including payments for illicit substances, transfers among criminal actors, laundering of criminal proceeds and the movement of funds across jurisdictions.

The methodology presented in the publication contributes to ARIEN’s broader objective of transforming complex and heterogeneous data into meaningful intelligence for competent authorities.

Its contribution can be understood through the following analytical process:

collection of blockchain data → analysis of wallet behaviour over time → identification of anomalous patterns → prioritisation of suspicious entities → further financial and criminal investigation.

By helping investigators focus on wallets displaying unusual characteristics, anomaly-detection technologies can reduce the amount of data requiring manual examination and support a more efficient allocation of analytical resources.

Supporting financial investigations related to drug trafficking

Financial investigation is a fundamental component of the fight against organised drug trafficking. Criminal networks depend on financial infrastructures to receive payments, transfer proceeds, purchase logistical services and conceal the origin of illicit assets.

The ability to identify anomalous cryptocurrency activity can therefore complement more traditional investigative approaches, including the analysis of bank transactions, companies, beneficial ownership structures, physical assets and relationships among criminal actors.

Within the ARIEN framework, methods such as the one explored in the publication may contribute to:

• identifying cryptocurrency wallets requiring further investigation;
• detecting unusual temporal patterns in financial activity;
• supporting the analysis of potential links between wallets and criminal networks;
• prioritising investigative leads in large blockchain datasets;
• strengthening the financial dimension of drug-trafficking investigations;
• supporting intelligence-led and data-driven decision-making.

An anomaly detected by an artificial intelligence model does not, by itself, constitute evidence of criminal activity. It represents an analytical indicator that must be assessed together with additional financial, operational, legal and contextual information.

For this reason, the publication is also consistent with ARIEN’s practitioner-oriented approach, in which artificial intelligence supports — rather than replaces — the expertise and judgement of investigators and analysts.

Towards transparent and responsible artificial intelligence

The use of artificial intelligence in sensitive security and law-enforcement contexts requires particular attention to transparency, reliability and human oversight.

Semi-supervised anomaly detection offers an important advantage because it does not automatically classify every unusual wallet as criminal. Instead, it identifies deviations from learned legitimate behaviour and makes them available for further examination by qualified professionals.

This supports a human-centred investigative process in which algorithmic results can be combined with blockchain analysis, intelligence information, investigative hypotheses and legally obtained evidence.

The research therefore contributes not only to the technological objectives of ARIEN, but also to the project’s wider commitment to developing responsible, explainable and operationally relevant artificial intelligence tools.

View ARIEN’s Community on Zenodo to read the complete publication.