Temporal Motif-aware Graph Test-time Adaptation for OOD Blockchain Anomaly Detection

1 Introduction 1

Blockchain transaction networks consist of large-scale, directed, and temporally ordered interactions, where anomalous behaviors continuously evolve. This dynamic nature makes blockchain anomaly detection particularly challenging under distribution shifts and limited supervision. Cryptocurrencies on decentralized blockchains, such as Bitcoin and Ethereum, are widely used and support millions of transactions daily 2 . Although blockchain transparency enables public verification, it also allows illicit activities to hide within legitimate transaction flows, especially in programmable environments enabled by smart contracts [Chen et al., 2020].

∗Corresponding Author

1 Due to space limitations, an extended version of this paper is available at arXiv:2605.29526.

From a modeling perspective, blockchain transactions can be represented as directed temporal multi-graphs, motivating graph-based Blockchain Anomaly Detection (BAD) methods for asset flow analysis and anomalous group discovery [Qi et al., 2023; Luo, 2024]. However, anomalous behaviors on blockchains are non-stationary and evolve with emerging cryptocurrency techniques and attack strategies [Yao et al., 2024]. Thus, models trained on historical data often suffer from severe out-of-distribution (OOD) issues in real-world deployment.

Early detection efforts relied on hand-crafted features and traditional machine learning models to detect Ponzi schemes [Chen et al., 2018], trace cryptocurrency scams [Phillips and Wilder, 2020], and identify phishing transactions [Yuan et al., 2020]. With the development of deep graph learning, recent studies have shifted toward end-to-end representation learning for money laundering detection [Weber et al., 2019] and account de-anonymization on Ethereum [Zhou et al., 2022]. More generally, Graph Anomaly Detection (GAD) methods have addressed challenges such as heterophily and label imbalance, as exemplified by DGAGNN [Duan et al., 2024] and SpaceGNN [Dong et al., 2025]. Despite these advances, most existing methods rely on supervised learning and remain sensitive to distribution shifts in blockchain data.

2 https://etherscan.io/txs

Our closer inspection of transaction behaviors suggests that many complex patterns can be decomposed into fine-grained temporal motifs. As shown in Figure 1, anomalous and benign nodes exhibit distinct temporal motif patterns on both the AlphaHomora dataset and a real-world money-laundering dataset. Moreover, we find that improved detection performance is often accompanied by adaptive changes in adversarial behaviors, further exacerbating distribution shifts. These observations reveal two unresolved challenges: (i) existing GADmethods rarely model temporal motifs explicitly, limiting their ability to capture evolving adversarial patterns; (ii) supervised learning approaches struggle to adapt to structural changes under OOD settings.

In this work, we collaborate with Zhejiang Provincial Public Security Department, which provides reliable onchain anomaly labels and cases, to detect OOD anomalies on blockchains using public transaction records and provided labels. Specifically, we propose a TEmporal Motifaware Graph Test-Time Adaptation (TEMG-TTA) framework to enable explicit temporal motif perception for OOD blockchain anomaly detection. First, we design an efficient motif matching algorithm that reduces the time complexity from O(M 3 ) to O(M · k2 ), where M is the number of transactions and k is the maximum number of edges within a constrained time window. Next, we construct a comprehensive temporal motif representation for each active node by incorporating shared motif prototype embeddings, role representations, and positional encodings. Finally, we introduce a trustable node selection mask and a teacher-student regularization mechanism to facilitate graph TTA on blockchains and mitigate disruptive deviation. Extensive experiments on four public datasets and one private dataset demonstrate that TEMG-TTA significantly outperforms state-of-the-art GAD approaches by an average of 54.88%.

Our main contributions are summarized as follows:

• We collaborate with a Provincial Public Security Department to detect suspicious Ethereum transactions in real time and report anomalous addresses with specified patterns, such as anomalous exchangers.
• We propose TEMG-TTA, a temporal motif-aware graph test-time adaptation framework that improves structural expressiveness and robustness to temporal distribution shifts for blockchain anomaly detection.
• Extensive experiments on multiple real-world blockchain datasets show that our method consistently outperforms state-of-the-art baselines and remains robust under temporal distribution drift. In-depth motif analysis and ablation studies further demonstrate the effectiveness of different components.

2 RelatedWorks

Graph Anomaly Detection. Graph neural networks (GNNs) have shown strong effectiveness in graph anomaly detection (GAD) [Qiao et al., 2025b]. Recent studies address heterophily and imbalance in GAD, such as H2GCN [Zhu et al., 2020], PMP [Zhuo et al., 2024], and ConsisGAD [Chen et al., 2024]. Graph foundation models (GFMs), including UNPrompt [Niu et al., 2024], ARC [Liu et al., 2024], and AnomalyGFM [Qiao et al., 2025a], further aim to improve generalization to complex abnormal patterns. However, these methods generally assume stationary distributions and struggle with continuously evolving blockchain transaction patterns.

Dynamic and Spatiotemporal Graph Modeling. Dynamic and spatiotemporal graph modeling has been widely studied for evolving behavioral patterns. Representative studies model temporal aggregation and propagation for dynamic graph representation [Zheng et al., 2023], incorporate spatiotemporal graph structures for human mobility simulation [Wang et al., 2024b], and use Transformer-based transfer learning for cross-city trajectory generation [Wang et al., 2024a]. These methods highlight the importance of temporal evolution and transferable behavioral patterns, but mainly target mobility or general dynamic representation learning rather than label-scarce anomaly detection on rapidly evolving cryptocurrency transaction graphs.

Motif in Graph. Traditional GNNs aggregate pairwise connections and are limited by the expressive power of the 1-WL test [Lee et al., 2019]. Graph motifs, as recurring higher-order subgraphs, have been used to enhance structural expressiveness, including motif-based attention [Lee et al., 2019], motif-augmented attributed networks [Huang et al., 2021], and motif-based GNNs [Monti et al., 2018]. Nevertheless, most motif-based methods ignore temporal and directional information or require explicit graph augmentation, limiting their scalability on large dynamic transaction graphs.

Graph Test-time Adaptation. Test-time adaptation (TTA) adapts pre-trained models to distribution shifts during inference without labeled data. Existing graph TTA methods rely on min-max optimization for test-domain adaptation [Chen et al., 2022], graph structure editing [Jin et al., 2022], regularized prototype supervision [Zhao et al., 2025], edgeimportance-based graph augmentation [Zhang et al., 2024], or homophily-based pseudo-label denoising [Zheng et al., 2025]. However, they mainly handle global distribution shifts and may overlook fine-grained transactional patterns crucial for cryptocurrency fraud detection.

Summary of Differences. Overall, existing studies provide valuable foundations but remain insufficient for blockchain fraud detection. GAD and graph foundation models mainly rely on static representations, motif-based GNNs often suffer from temporal or scalability limitations, and graph TTA methods usually overlook fine-grained higher-order transaction structures. Moreover, real-time intelligent big data processing emphasizes scalable analysis over continuously generated large-scale streams [Zheng et al., 2019], which is important for practical blockchain monitoring. Different

Algorithm 1 Motif Matching

Input: Transaction set R

Parameter: Maximum time window tw, edge limit k, aggregation range ∆t

Output: Motif count matrix C

• 1: Sort transactions in R by timestamp
• 2: Initialize motif counts C
• 3: if time aggregation is enabled then
• 4: Aggregate same-direction transactions within [ti - ∆t, ti] into ˜R
• 5: else
• 6: ˜R=R
• 7: end if
• 8: for each transaction ri ∈ R do
• 9: Sample at most k historical transactions from ˜Rwithin [ti - tw, ti] as Si
• 10: for each pair (rj , rm) in Si with tj < tm < ti do
• 11: 12:
• if {rj , rm, ri} forms a 3-node temporal motif then
• Update the corresponding motif-role count in C
• 13: end if
• 14: end for
• 15: end for
• 16: return C

from these works, our approach jointly integrates motif-aware modeling with label-free test-time adaptation, enabling efficient adaptation to evolving higher-order transaction patterns in dynamic blockchain systems.

3 Method

3.1 Blockchain Transaction Graph

Given a cryptocurrency transaction set R = {r1, . . . , rM}, each transaction is denoted as ri = (si, ei, ti, ci), where si, ei, ti, and ci denote the sender, receiver, timestamp, and amount, respectively. We formulate R as a directed temporal multi-graph G = (V,E,X), where V = {si} ∪ {ei} is the address set with |V | = N, E = {ri}Mi=1 is the transaction set, and X ∈ RN×d denotes node features. Our goal is to learn a GNN-based classifier ˆyi = GNNθ(vi|G) to distinguish benign and anomalous addresses.

3.2 Temporal Motif-aware Graph Representation

Temporal Motif Computation. Existing GAD methods mainly rely on multi-hop graph aggregation and node-level classifiers, making it difficult to capture fine-grained intraand inter-anomaly transaction patterns. We therefore introduce temporal motifs to characterize higher-order transaction behaviors and enhance node representations.

Motifs are recurring subgraph patterns. In this work, we focus on 3-node and 3-edge temporal motifs, which capture interactions beyond pairwise connections while remaining computationally tractable [Paranjape et al., 2017], as shown in Figure 3. Two-node patterns can be captured by ordinary GNN aggregation, whereas four-node motifs are much more expensive and harder to represent compactly. Algorithm 1 shows our motif matching procedure. With edge limitation and time aggregation, the complexity is reduced fromO(M 3 ) to O(M · k2 ). The resulting motif-role counts are stored in C ∈ RN×(3×36) .

Temporal Motif Representation. Given 36 temporal motif types, we learn a shared motif prototype matrix M = [m1, . . . ,m36]. For each motif type mk and each node role q, we construct a role-aware motif embedding using the motif prototype, a learnable role embedding rk,q, and a positional encoding pk,q. For a motif mk = (V ′ ,E′ ), where E′ = {ej}3j=1 and ej = (esrc j , edst j , tj), the positional encoding of node vq is defined as

where T (tj) = sin(ωtj + θ) encodes temporal order, and E(vq, ej) = MLP([1(vq = esrc j ), 1(vq = edst j )]) encodes edge-level source/destination roles. The motif-role embedding is then obtained by

We collect all motif-role embeddings into Hm ∈ R(3×36)×dh and compute node-level motif features as

Temporal Motif-enhanced Node Representation. We fuse original node features with motif features by

where Wf and b are learnable parameters, and X denotes the fused node features.

3.3 Graph Pre-training

We divide learning into graph pre-training and test-time adaptation. In pre-training, the motif-enhanced graph is fed into a GNN backbone, which can be GCN [Kipf, 2016], GraphSAGE [Hamilton et al., 2017], SpaceGNN [Dong et al., 2025], or DGAGNN [Duan et al., 2024]. The general GNN pipeline is written as

where UpdateL is the L-th layer update function, zLvi is the representation of vi, and z0vi = xi ∈ X. The model is optimized with binary cross-entropy:

We optimize θ by back-propagation and apply early stopping based on validation AUC-PRC with tolerance τtolerance.

3.4 Graph Test-time Adaptation for Blockchain

In test-time adaptation (TTA), we adapt the pre-trained model to an unlabeled test graph Gtest whose distribution differs from the training graph. We initialize two identical GNNs from the pre-trained model: a student GNNSθ for adaptation and a teacher GNNTθ for stable supervision.

To avoid over-confident pseudo supervision [Wu et al., 2020], we select reliable but non-trivial nodes using a confidence mask:

where pi = max softmax(ˆyT i ) is the teacher confidence, and B = {i | Bi = 1}. At each adaptation step, we compute

where ˜ Gtest is obtained by random edge dropping to produce a semantic-preserving perturbation. We regularize the student by matching teacher and student embeddings:

To improve robustness to unstable blockchain patterns, we further adopt an InfoNCE loss [Oord et al., 2018]:

where sim(h, h′ ) = exp(cos(h, h′ )/τ). For each node vi, positives are sampled from nodes with similar motif features, i.e., cos(xmi , xmj ) > γ, while the remaining sampled nodes are treated as negatives N - i . The final TTA objective is

where β controls the contrastive regularization strength. We update the student parameters θS by back-propagation and update the teacher by exponential moving average:

With α ∈ [0.9, 0.999], the teacher preserves source-domain knowledge while gradually tracking the adapted student, reducing catastrophic forgetting during TTA. During each training progress, α is fixed.

4 Experiments

4.1 Experiment Setting

Datasets. We conduct experiments on five real-world blockchain anomaly detection datasets, as shown in Table 1. AlphaHomora (Alpha), CryptopiaHacker (Crypto), PlusTokenPonzi (Plus), and UpbitHack (Upbit) are from [Lin et al., 2024], while our private dataset Trace is collected through collaboration with our real-world partner.

Baselines. We evaluate TEMG-TTA with several GNN backbones, including Graph Convolutional Network (GCN) [Kipf, 2016], GraphSAGE (SAGE) [Hamilton et al., 2017], SpaceGNN (SGNN) [Dong et al., 2025], and DGAGNN (DGA) [Duan et al., 2024]. We use GADBench [Tang et al., 2023] implementations for the first three models and the official implementation for DGAGNN. We also attempted temporal GNN baselines such as DyGFormer [Yu et al., 2023] and SALoM [Liu et al., 2026], but their training cost is prohibitive on blockchain transaction graphs, with several runs exceeding 24 hours on public datasets and becoming harder on Trace. Following prior GAD studies, we therefore use representative GNN-based anomaly detection backbones for the main comparison and focus on the consistent gains brought by TEMG-TTA.

Evaluation protocol. To prevent data leakage, we record the activation time of each anomalous node and split the training, validation, and test sets chronologically with a ratio of 6:2:2. Due to severe class imbalance, we do not use accuracy. Instead, we evaluate anomaly detection performance using Area Under the Precision-Recall Curve (AUC-PRC), Recall@k (Rec@k), and F1-score. AUC-PRC measures the overall ranking quality under imbalance, Rec@k evaluates the coverage of high-risk nodes in practical top-k inspection, and F1-score reflects the balance between precision and recall under a decision threshold of 0.5. We set k as the number of anomalous nodes in the test set.

Implementation details. We train each model for 200 epochs with early stopping based on validation AUC-PRC and run 10 epochs for TTA. Unless otherwise specified, motif extraction uses k = 100 and ∆t = 3600. Since TTA requires hidden embeddings on the test graph, we modify all backbones to output the hidden embeddings before the classifier. For DGAGNN, we disable its source graph oriented super mask during TTA. All experiments are conducted on 2 Intel Xeon Platinum 8260L CPUs, 256 GiB RAM, and an NVIDIA GeForce RTX 4090 GPU with 24 GiB VRAM.

4.2 Overall Comparison

Table 2 compares the performance of "Original" models without TTA and "Ours" with TEMG-TTA. Here, "-" denotes out-of-memory (OOM) errors, "tr." and "te." denote "train on" and "test on", respectively. Overall, TEMG-TTA preserves the anomaly detection ability learned from the source dataset while adapting the model to shifted test distributions.

Following Table 1, we use the anomaly ratio of each test dataset as the random AUC-PRC baseline. When the original model performs poorly, such as transferring from CryptopiaHacker to PlusTokenPonzi, the source and target datasets exhibit clear distribution shifts, and TEMG-TTA consistently improves performance through test-time adaptation. When the original model already performs well, such as transferring from AlphaHomora to CryptopiaHacker, TEMG-TTA still maintains or further improves the performance, indicating that the adaptation process does not severely damage sourcedomain knowledge.

The OOM cases mainly occur when combining the large Trace dataset with SpaceGNN. During TTA, maintaining both teacher and student models further increases memory consumption, making SpaceGNN infeasible on Trace under our hardware setup.

4.3 Case Study on Temporal Motif Patterns

To verify whether temporal motifs can capture meaningful anomalous behaviors, we analyze common motif patterns in our private dataset. As shown in Figure 4, we group motifs by their basic structures and present representative cases verified by our partner.

Group (a) shows a distribution pattern from node-0. In our cases, the most common receiver in this pattern is a private exchange service frequently used in fraud cases, while the other receiver is the suspicious node labeled as fraud. Although such distribution patterns are common on blockchains, they become strong fraud signals within a short time window because malicious actors often avoid using the same account for a long period.

Group (b) shows aggregation patterns, where assets are collected into one account before payment. Due to temporalorder constraints, only motif (r6, c3) clearly indicates this behavior. In the first case, the middle node aggregates assets from an exchange service and sends them to the fraud-related target node. In the second case, the aggregation node itself is suspicious, corresponding to a cash-out pattern according to our partner. This indicates that fraud-related addresses may repeatedly receive assets from upstream addresses and forward them downstream, forming distinctive temporal aggregation motifs.

4.4 Ablation Study

Temporal Motif. To verify the effectiveness of the proposed motif representation, we conduct ablation experiments on four public datasets with different GNN backbones. As shown in Table 3, motif representation consistently improves anomaly detection performance, especially on AlphaHomora and UpbitHack. GCN obtains the most significant improvement, suggesting that motif features can compensate for its limited structural expressiveness. The minor improvement on PlusTokenPonzi may be due to its high anomaly ratio and nearly saturated prediction performance, leaving limited room for further gains.

4.5 Parameter Analysis

Edge limit k and time aggregation range ∆t. We analyze the impact of k and ∆t on motif representation, with results shown in Table 4. In most settings, a proper edge limit and time aggregation range improve anomaly detection performance. The edge limit focuses motif extraction on temporally relevant transactions, while time aggregation reduces duplicate transaction patterns. We further evaluate the runtime efficiency of motif matching on real-world transaction graphs, as reported in Table 5. The results show that k and ∆t substantially reduce computational cost, demonstrating the practical scalability of our motif extraction method on large-scale blockchain datasets with over 1 million nodes and 2 million edges.

In deployment, TEMG-TTA runs on localized k-hop subgraphs around seed accounts instead of the full blockchain graph. Motif matching costs about 0.12 ms per edge, and forward/backward passes take 40.25/169.69 ms, leading to second-level latency under Ethereum-scale throughput and supporting real-time on-chain fraud detection.

Teacher model momentum α. The teacher momentum α controls how much information the teacher model receives from the student model. We evaluate different values of α using GCN. As shown in Table 6, a larger α usually weakens TTA performance, such as in the transfer from AlphaHomora to PlusTokenPonzi, because it slows down knowledge adaptation from the student model.

Trustable node selection thresholds τlow and τhigh. The thresholds τlow and τhigh define the confidence range for selecting trustable nodes, as summarized in Table 7. Increasing τhigh or decreasing τlow generally expands the selected node set and helps the model capture more useful adaptation signals. However, this benefit only holds within a proper range: an excessively high τhigh may introduce over-confident predictions, while an overly low τlow may include noisy lowconfidence nodes, both of which degrade TTA performance.

5 Conclusion

In this work, we propose TEMG-TTA, a temporal motifaware graph test-time adaptation framework for blockchain anomaly detection. TEMG-TTA integrates 3-node temporal motif representations with original node features to capture fine-grained higher-order transaction patterns. It further introduces a simple yet effective test-time adaptation strategy to mitigate distribution shifts caused by evolving malicious behaviors and adversarial transaction patterns.

Extensive experiments on real-world blockchain datasets demonstrate that TEMG-TTA consistently outperforms classical and state-of-the-art graph anomaly detection models. The case study on temporal motif patterns provides interpretable evidence that our method can characterize meaningful fraud-related transaction structures. Ablation studies further verify the effectiveness of both temporal motif representation and test-time adaptation, showing how different components contribute to the overall performance.

Beyond experimental evaluation, TEMG-TTA has also been validated in collaboration with a public security department. In 2025, it was applied to real-world blockchain transaction data and supported the detection of suspicious transactions involving more than 1 million USDT. This practical validation demonstrates the potential of TEMG-TTA for realtime on-chain risk monitoring and provides evidence of its real-world impact in blockchain fraud detection.

For future work, it is promising to incorporate large language models (LLMs) into blockchain anomaly detection, given their strong zero-shot inference and natural-language understanding capabilities. LLMs could help integrate heterogeneous information sources, such as smart-contract code, transaction metadata, and off-chain reports, thereby improving detection performance while providing more interpretable explanations for detected anomalies.

Acknowledgments

This work is supported by the Zhejiang Province "JianBingLingYan+X" Research and Development Plan (2025C02020).