ART: A Graph-based Framework for Investigating Illicit Activity in Monero via Address-Ring-Transaction Structures

TL;DR

This paper introduces ART, a graph-based framework that analyzes Monero's transaction structures to identify illicit activities, aiding law enforcement in tackling privacy-preserving cryptocurrencies.

Contribution

It presents a novel graph-based methodology and machine learning approach to detect criminal patterns in Monero transactions, addressing the challenge of privacy features.

Findings

Structural and temporal features effectively distinguish criminal transaction patterns.

Machine learning models achieve promising accuracy in identifying illicit activities.

The framework supports investigative efforts in privacy-focused blockchain ecosystems.

Abstract

As Law Enforcement Agencies advance in cryptocurrency forensics, criminal actors aiming to conceal illicit fund movements increasingly turn to "mixin" services or privacy-based cryptocurrencies. Monero stands out as a leading choice due to its strong privacy preserving and untraceability properties, making conventional blockchain analysis ineffective. Understanding the behavior and operational patterns of criminal actors within Monero is therefore challenging and it is essential to support future investigative strategies and disrupt illicit activities. In this work, we propose a case study in which we leverage a novel graph-based methodology to extract structural and temporal patterns from Monero transactions linked to already discovered criminal activities. By building Address-Ring-Transaction graphs from flagged transactions, we extract structural and temporal features and use them to train Machine Learning models capable of detecting similar behavioral patterns that could highlight criminal modus operandi. This represents a first partial step toward developing analytical tools that support investigative efforts in privacy-preserving blockchain ecosystems