Fraud Detection for Crypto Exchanges: On-Chain and Off-Chain Signals

Two signal worlds, one decision

A crypto exchange sits between the traditional financial system and the blockchain, and its fraud problem has a foot in each. Crypto exchange fraud detection combines the off-chain signals a payments processor would recognise — device, identity, funding, behaviour — with on-chain analytics on the addresses money moves to and from. Neither half is sufficient alone.

The off-chain half

This is familiar territory: account takeover, credential stuffing, application fraud, and the same behavioural signals that drive any fraud model — device reputation, login anomalies, a spending or trading pattern break, velocity on deposits and withdrawals, geolocation versus stated residence. A returning user suddenly trading from a new device and rushing to withdraw looks like takeover here the same as it does anywhere.

The on-chain half

The blockchain adds signals a card network doesn't have:

• Deposit address reputation. Is the incoming address associated with a known theft, a sanctioned entity, a scam, or a mixer?
• Withdrawal destination risk. Is the user trying to send funds straight to a mixer, a high-risk jurisdiction service, or an address that's been flagged?
• Proximity to tainted funds. How many hops separates this user's activity from a known-bad address.
• Chain-hopping and structuring patterns that look like an attempt to break the trail.

These come from on-chain analytics providers or an in-house graph over the ledger, and they're probabilistic — an address a few hops from a mixer isn't proof of anything, it's a signal to weight.

Combining them

The pattern holds: a gradient-boosted model over the engineered off-chain and on-chain features for the fast, calibrated score, a language-reasoning layer over the narrative — the funding story, the withdrawal rationale, the KYC documents — for what the features miss, combined before a routing decision. This is the shape of our fraud-scoring project: a boosted baseline plus a concurrent reasoning layer, with an event log that makes every decision reconstructable — which matters as much for a regulator asking about a withdrawal as it does for a card decline.

The withdrawal is the control point

Deposits are reversible in the sense that you can freeze an account; a withdrawal to an external address is not. So the scrutiny is asymmetric — a borderline deposit can be accepted and watched, a borderline withdrawal holds for review. Confidence-based routing with a soft-hold queue is the mechanism, and the withdrawal side gets the tighter band.

Where the on-chain features come from

You have two options for the on-chain half: subscribe to an on-chain analytics provider that supplies address labels, taint scores, and exposure metrics as an API, or build a graph over the ledger yourself and compute proximity and flow features in-house. Buy is the default — the label datasets and heuristics are a specialist product and hard to replicate — unless on-chain risk assessment is core to what you sell. Either way, the output feeds the same feature store as the off-chain signals.

Sanctions screening is adjacent, not the same thing

An address matching a sanctions list is a hard block and a reporting obligation, not a number the fraud model weighs. Run sanctions and watchlist screening as its own deterministic check alongside the fraud score, with its own audit trail. Blending it into a probabilistic risk score is how a compliance failure hides inside a "medium risk" rating.

Where this stops being right

• A pure custodial wallet with no trading and no fiat rails has a narrower problem — mostly withdrawal screening.
• On-chain analytics is not ground truth — address attribution is incomplete and contested; treat it as a weighted signal, not a verdict.
• Regulation is moving fast — travel-rule and sanctions obligations differ by jurisdiction and change; the compliance layer needs its own review, separate from the fraud model.

FAQ

Is on-chain analysis enough on its own? No. It catches destination and source risk but says nothing about whether the person operating the account is who they claim to be. You need the off-chain behavioural half too.

What's the highest-scrutiny action? An external withdrawal — it's irreversible. Borderline withdrawals hold for review; borderline deposits can be accepted and monitored.

Is address attribution reliable? Partially. It's incomplete and sometimes disputed, so it's a signal to weight, not proof. Combine it with off-chain signals rather than acting on it alone.

ISTRALLEN builds fraud scoring that combines off-chain behavioural signals with on-chain risk, routed by confidence with a tighter band on withdrawals; see AI for Fintech.