Explainable Graph Neural Networks for Multi-Class Fraudulent Address Classification in Ethereum

Abstract

Blockchain networks have become a major target for fraudulent activities, including phishing and scamming attacks, due to the irreversible and pseudonymous nature of cryptocurrency transactions. Existing Ethereum fraud detection studies commonly formulate the problem as a binary classification task, which limits their ability to distinguish among different malicious behaviors. This paper proposes an explainable Graph Neural Network-based framework for multi-class Ethereum address classification using an enhanced version of the Benchmark Labeled Transactions Ethereum (BLTE) dataset. The original binary BLTE dataset is extended into a multi-class dataset by integrating external attack-category information and labeling addresses as Normal, Phishing, or Scamming. The resulting BLTE multi-class dataset contains 73,033 Ethereum addresses, 23 behavioral node features, and 6588 directed transaction edges. Three GNN architectures, namely Graph Attention Network (GAT), Graph Convolutional Network (GCN), and GraphSAGE, are evaluated under identical experimental settings. Across ten stratified random seeds, GraphSAGE achieves the best overall performance among the implemented GNNs, with 98.84±0.06% accuracy, 80.42±2.67% macro recall, 51.08±1.54% macro F1-score, and 99.27±0.03% weighted F1-score. To improve model transparency, GNNExplainer is used to identify influential transaction subgraphs and important node features that contribute to each prediction. The results indicate that neighborhood-aware graph learning is useful for multi-class Ethereum address classification, while also showing that minority-class precision remains challenging under severe class imbalance. A feature-only multilayer perceptron is found to be a strong baseline whose macro F1-score is statistically indistinguishable from GraphSAGE after multiple-comparison correction; the improvement attributable to graph structure is therefore modest and concentrated on the small connected portion of the network, and external validation on independent datasets is still required before the framework is used in real investigations.