Revisiting Elliptic++ for Bitcoin Forensics: Feature Reconstruction and Leakage-Resistant Evaluation (arXiv (Cornell University))

Summary

• Elliptic and its address-level extension Elliptic++ are widely used Bitcoin forensics benchmarks, cited by more than 1,300 academic studies according to Google Scholar.p.1
• The paper revisits how the 55 Elliptic++ address-level features are computed and proposes a leakage-resistant pipeline.p.1
• The Kondor 2020 ledger release lists 609,963,452 addresses, and its input and output tables hold 1.22 and 1.33 billion rows.p.4
• The 55 features are recomputed from a per-transaction table with 367,517 rows, aggregated to one row per address.p.5
• With leakage-resistant features under the temporal split, the random forest F1 is 0.291.p.8

Key insights

1. Elliptic++ is affected by future information leakage because its positional data split does not respect temporal order.p.1
2. The exact definitions of the Elliptic++ address-level features were undocumented and are recovered by linking Elliptic transactions to public ledger data.p.1
3. Both datasets are widely used in Bitcoin forensics research, and the Kondor release is organised as relational tables of blocks, transactions, inputs and outputs.p.4
4. Exact identities among features are checked on 172,903 training addresses for both released and leakage-resistant features.p.6
5. The temporal split trains on addresses first seen in Elliptic time steps 1–34 and tests on those first seen in steps 35–49.p.8
6. Dropping either the 86 or the 137 addresses that diverge from released values leaves model performance unchanged.p.10