## 3 Datasets  
In studies of Bitcoin behavior, it is difficult to identify a ground-truth labeled dataset due to the anonymity of the network and due to the activity of its entities, which can change over time. However, here we aim to analyze these changes and determine how they affect the entity behavior classification. Such change in the classification over time may help us determine suspicious situations and sensitive targets. We therefore used two datasets, the first one downloaded from WalletExplorer [39]--a platform that can be considered a benchmark for Bitcoin entities detection--and the second one consisting of Bitcoin blockchain data downloaded from the mainet [40]. WalletExplorer is a web-page where data and information about different known entities detected until today are collected. The dataset is continuously being updated and its information has been used as a starting point for many Bitcoin-related studies, such as [15; 32; 41]. For our purpose, each entity was downloaded with its origin name and its related detected addresses. The downloaded entities belong to seven different classes:  
* _Exchange_: entities that allow their customers to trade cryptocurrencies or to exchange cryptos for fiat currencies (or vice versa);
* _Gambling_: entities that offer gambling services based on Bitcoin currency (casino, betting, roulette, etc. );* _Mining Pool_: entities composed of a group of miners that work together sharing their resources in order to reduce the volatility of their returns;
* _Mixer_: entities that offer a service to obscure the traceability of their Bitcoin clients' transactions;
* _Marketplace_: entities allowing to buy any kind of goods or services using cryptocurrencies. They are frequently used to buy illegal goods;
* _eWallet_: entities that allow an individual to create online accounts that can be used to receive and send money. Users never need to download the Bitcoin software themselves and all of the user's transactions are made on behalf of the user by the eWallet service, using keys controlled by the service [23];
* _Lending_: entities that allow users to lend Bitcoins and passively earn interests on it, or allow them to request a loan. As shown in Table 1, 315 different entities and more than 18,000,000 addresses were downloaded from WalletExplorer. However, after creating a first overview of the dataset, we decided to not use the _Lending_ class because seven entities were considered too few to implement and train the cascading machine learning system. The second dataset was directly downloaded from the Bitcoin mainnet through the Bitcoin Core program [42]. Our analysis focuses on the last (about) three years of lifetime of Bitcoin blockchain only, so we used the Bitcoin blockchain data created from blocks height 390,000 to 570,000, corresponding to blocks mined from 24 December 2015, 5:33:51 p.m. until 3 April 2019, 9:20:08 a.m., respectively. This decision was taken in order to decrease the computational cost for carrying out the experiments. Table 1 shows the amount of different entities and addresses calculated in the last three years as well, and the ratio between the samples in the considered time interval compared to the whole population. The final dataset was composed by data belonging to six classes: _Exchange_, _Gambling_, _Marketplace_, _Mining Pool_, _Mixer_, and _eWallet_. All entities were represented by more than 65% of distinct samples, and also by more than 50% of distinct addresses, except for the _Marketplace_ with just 7.32% of samples. A first analysis highlighted that these _Marketplace_ entities were mainly active in the first six years of the blockchain lifetime. Then, over time, they were closed from Law Enforcement Officers (LEOs) in case of illicit activities or owners decided to close their services.