What Signal Detects Ethereum Fraud? Degree Counts versus True Graph Topology, with Transaction and Temporal Behaviour

Abstract

This is an independent research project with publicly released, reproducible code (not a peer-reviewed publication). We ask which class of behavioural signal drives machine-learning detection of fraudulent Ethereum accounts: graph, transaction (value/volume), or temporal (timing) features, on 9,307 labelled accounts. Crucially we distinguish degree-count graph features from true graph-topology features (PageRank, k-core, clustering, degree centrality) reconstructed from a 242,518-node, 1.65M-edge transaction graph. Transaction-value features are the strongest single class (PR-AUC 0.93), but true graph-topology significantly outperforms degree counts (PR-AUC 0.84 vs 0.70, p<1e-6) and adds the most on top of transaction features; PageRank is the single most informative feature. The topology result survives a time-respecting leakage audit (features rebuilt from each account's earliest 70% of transactions). All code, data pointers, figures, and tests are released.