TWIN-GNN: An Interpretable Multi-Graph Framework for Illicit Bitcoin Transaction and Wallet Detection

Bitcoin’s pseudonymous ledger is widely exploited for money laundering, and the Elliptic++ dataset—the only large public resource with linked transaction- and wallet-level illicit-activity labels—makes it possible to study both granularities jointly, yet prior graph-neural-network work models only one graph. We propose TWIN-GNN (Transaction–Wallet Interpretable Network), which encodes the transaction and wallet graphs with separate GraphSAGE encoders fused through a bipartite cross-graph attention layer over the dataset’s real address-to-transaction edges, giving each prediction human-auditable attention weights over the entities that influenced it. Labels, normalization, and model selection follow a strict chronological protocol, whereas message passing is transductive over the full graph, a limitation we quantify. On Elliptic++ (203,769 transactions; 822,942 wallets), a single TWIN-GNN run improves wallet-level illicit-actor detection over the strongest tabular baseline (PR-AUC 0.624 vs. 0.372, +67.7%; F1 0.494 vs. 0.389, +27.0%), while transaction-level classification remains best served by gradient-boosted trees on engineered features (LightGBM F1 = 0.807 vs. 0.439), consistent with evidence that graph structure can become a liability under temporal shift. Multi-graph fusion is thus not uniformly beneficial, but it offers an interpretable gain for actor-level anti-money-laundering triage, the granularity at which real investigations act.