Title: BlockScan: Detecting Anomalies in Blockchain Transactions
Venue: NeurIPS 2025
Accepted: yes
Keywords: foundation model

blockchain transaction
Abstract: We propose BlockScan, a customized Transformer for anomaly detection in blockchain transactions.
Unlike existing methods that rely on rule-based systems or directly apply off-the-shelf large language models (LLMs), BlockScan introduces a series of customized designs to effectively model the unique data structure of blockchain transactions.
First, a blockchain transaction is multi-modal, containing blockchain-specific tokens, texts, and numbers.
We design a novel modularized tokenizer to handle these multi-modal inputs, balancing the information across different modalities.
Second, we design a customized masked language modeling mechanism for pretraining the Transformer architecture, incorporating RoPE embedding and FlashAttention for handling longer sequences.
Finally, we design a novel anomaly detection method based on the model outputs.
We further provide theoretical analysis for the detection method of our system. 
Extensive evaluations on Ethereum and Solana transactions demonstrate BlockScan's exceptional capability in anomaly detection while maintaining a low false positive rate.
Remarkably, BlockScan is the only method that successfully detects anomalous transactions on Solana with high accuracy, whereas all other approaches achieved very low or zero detection recall scores.
This work sets a new benchmark for applying Transformer-based approaches in blockchain data analysis.


Peer reviews:
comments: SUMMARY:
This paper proposes BlockScan, a new transformer-based anomaly detection framework for blockchain transactions. The authors develop various customization methods to improve the representation learning of the multi-model, complex data blockchain transactions. To detect anomalies in one chain, BlockScan uses the reconstruction error of the transaction as the metric. Empirical results and comparison with other detection methods show that BlockScan achieves better detection accuracy and lower false positives.

STRENGTHS AND WEAKNESSES:
This paper has the following strengths:
+ The authors develop customized pre-processing methods to handle hash values, numbers, and logs in the transaction data. 
+ The authors improve the capability of long sequence processing with RoPE embedding and FlashAttention. 
+ The authors provide theoretical proof for the anomaly detection hypothesis that the reconstruction error of anomalous transactions is higher than the error of benign transactions.  

This paper has the following weaknesses:
- The experiments section mentions that the collected transactions are processed by a per-application sequential split. This implies that BlockScan obtains one customized anomaly detection model for each application. However, there are diverse applications running on Ethereum or Solana. It's not clear whether BlockScan is scalable considering the volume and diversity of applications.  
- While the authors explain that the trade-off can be explored by selecting different values for the hyperparameter k, there is no clear guidance about how to choose the k value (nor the mask ratio g) in a practical setting.

QUESTIONS:
Please consider addressing the weaknesses discussed above.

LIMITATIONS:
Please consider addressing the weaknesses discussed above.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-16

comments: SUMMARY:
BlockScan integrates BERT-like pre-training techniques for detecting anomalies in blockchain transactions. The main specialized efforts lie in a multimodal tokenizer to handle high-frequency addresses, numeric values, and log text separately, and leverages mask language modeling for computing reconstruction errors. Some techniques like RoPE, FlashAttention are also adopted to enhance efficiency.

STRENGTHS AND WEAKNESSES:
Missing key reference: I found that there is a similar paper named BERT4ETH[1] that has already applied BERT-like pre-training technique for blockchain transactions two years ago, yet it is neither cited nor discussed in the related work. Based on my reading, there appear to be some similarities between BERT4ETH and BlockScan: both randomly mask tokens in transactions and compute reconstruction errors; both include mechanisms to handle high-frequency addresses. Given this, I strongly recommend that the authors explicitly discuss BERT4ETH in the related work section and clearly articulate the unique contributions of the proposed BlockScan.

[1] Bert4eth: A pre-trained transformer for ethereum fraud detection. Proceedings of the ACM Web Conference 2023. 2023.

QUESTIONS:
Please address the main weakness outlined in the “Strengths and Weaknesses”. The final score will be adjusted based on the rebuttal.

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nBlockScan presents a comprehensive and effective approach to blockchain anomaly detection by integrating behavioral signals across different structural levels. It addresses challenges in scalability, label scarcity, and diversity of malicious behaviors. The framework is modular, empirically validated, and applicable to real-world blockchain monitoring scenarios.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1.The paper introduces a well-structured framework that models anomalies at the account, transaction, and group levels.\nThis design reflects the hierarchical nature of blockchain ecosystems and captures diverse anomaly patterns.\n2.BlockScan outperforms strong baselines (e.g., GCN, MetaDetect, GAT, TransDetect) across multiple datasets (Ethereum, Tron) and evaluation metrics (AUC, AP). The method demonstrates consistent improvements in both supervised and semi-supervised settings.\n3.The use of self-supervised objectives (e.g., masked modeling, contrastive learning) effectively alleviates the scarcity of labeled anomaly data.\n\n Weaknesses\n1.The overall framework is novel, many core components (e.g., transformer encoder, contrastive loss, Infomap clustering) are reused from prior work without major innovation.\n2.Group-level modeling via community detection may not scale efficiently to large transaction graphs with millions of accounts — this is not analyzed in depth.\n3.The model is evaluated only on Ethereum and Tron. There is no discussion of how it generalizes to other blockchain networks (e.g., BNB, Solana) or unseen anomaly types.\n4.The paper focuses on performance metrics (AUC, AP) but lacks detailed analysis of failure modes, especially false positives, which are critical in real-world applications.\n\nQUESTIONS:\n1.The group-level module uses Infomap community detection, which may have high computational overhead on large-scale blockchain graphs. How scalable is this component on blockchains with millions of accounts and transactions?\n2.The method is evaluated only on Ethereum and Tron. Can BlockScan generalize to other blockchains (e.g., BNB Chain, Solana), especially those with different transaction semantics or graph topologies?\n\nLIMITATIONS:\nAs discussed above.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces BlockScan, a customized Transformer model for detecting anomalous blockchain transactions in DeFi ecosystems. It proposes a novel multi-modal tokenizer to handle blockchain-specific data, leverages BERT with MLM, RoPE, and FlashAttention for efficient training, and achieves superior performance.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n1. Using models for testing under blockchain has certain practical significance\n\n2. The multi-modal tokenizer effectively addresses the complexity of blockchain data, balancing vocabulary size and information retention.\n\n3. Outperforms baselines significantly, especially on Solana, where other methods fail (0% recall).\n\n# Weakness\n1. The methodological design and underlying ideas presented in this paper are relatively straightforward, with only incremental innovation in terms of techniques and conceptual contributions. Specifically, the proposed approach does not introduce any architectural novelties; instead, it merely utilizes traditional architectures (e.g., BERT) in a concatenation-based manner. Despite this, a considerable portion of the paper is dedicated to methodological description. In my opinion, the manuscript would benefit from reallocating this space toward a more thorough and convincing evaluation of the proposed detector. This could include a broader range of comparative baselines as well as more diverse test sets.\n\n2. The comparison methods appear to be evaluated on different datasets than the one used by the proposed approach. It raises the concern that the superior performance of BlockScan might be largely attributed to the quality or construction of its dataset. Moreover, the paper does not clearly distinguish between the training and testing sets. If the proposed model is trained on a dataset that closely matches the distribution of the test set, while the baselines are evaluated on a distribution-shifted test set, the reported improvements could be due to this discrepancy rather than the efficacy of the method itself. The authors should provide a more detailed explanation and analysis to rule out this possibility and convincingly demonstrate that the performance gains are not merely artifacts of dataset alignment.\n\n3. The paper lacks a fundamental introduction to blockchain technology, which is a core component of the proposed approach. This omission significantly affects the readability and accessibility of the work, particularly for readers who may not be deeply familiar with blockchain concepts. A concise but sufficient background section is necessary to contextualize how blockchain is utilized and why it is integral to the proposed method.\n\nQUESTIONS:\nPlease see weakness part\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 2, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-05"}