ChainSense
I led a 4-person team in UC San Diego's Data Science Student Society to profile Ethereum wallets by behavioral signatures (trading patterns, peers, activities, etc.). We engineered features from 650M transactions across 6.34M wallets for unsupervised clustering and discovered 18 wallet types, from DEX traders to bots, and even fraudulent wallets tied to phishing scams. We shipped a real-time ML inference pipeline that profiles any wallet and flags fraud live.
- Turned 650M transactions from BigQuery into 26 behavioral features for 6.34M wallets, using DuckDB over partitioned Parquet on a Mac mini.
- Clustered a 634K-wallet sample into 18 types with UMAP and HDBSCAN, then trained XGBoost to label the other 90%, sending low-confidence wallets to "Unclassified."
- Surfaced about 159K phishing-drain wallets without being told to look; Etherscan spot-checks confirmed 4 of the 18 clusters.
How it works
- Extract. 2.6M blocks (May 2025 – May 2026) from BigQuery's public Ethereum dataset.
- Features. Per wallet: activity, value flow, timing, gas cost, counterparties, and which contract functions it calls.
- Cluster. UMAP down to 10 dimensions, then HDBSCAN.
- Label. XGBoost assigns every other wallet; below 50% confidence it stays Unclassified.
- Serve. New wallets are classified live on a dashboard.
Why HDBSCAN, not k-means
We started with k-means, but it forces every wallet into some cluster, so rare behavior like phishing gets smeared into the big groups. HDBSCAN can call a wallet noise instead, which is why the phishing clusters stood out at all. The trade-off: 38% of the sample stays unclustered.
Naming clusters without hand-labels
Each cluster is named after the features where it differs most from the average wallet. The 18 clusters roll up into 7 families:
| Family | Share of wallets |
|---|---|
| Mainstream / Retail | 31.3% |
| DeFi Traders | 20.2% |
| Holders & Receivers | 7.9% |
| Token-Only | 3.6% |
| Bots & Automation | 3.2% |
| Compromised / Phishing | 2.5% |
| Minters | 1.0% |
| Unclassified | 30.5% |
Classifying new wallets live
The pipeline polls Alchemy every 12 seconds, staying 64 blocks behind the chain tip. About an hour after a wallet first appears, it computes 12 first-hour features with the same DuckDB SQL used in training, and a separate hourly XGBoost model labels it. FastAPI streams each label to the React dashboard over server-sent events.
Limits
- Fraud isn't measured for accuracy; the phishing families are backed by spot-checks, not a labeled test set.
- The live model sees only a wallet's first hour of activity.
- 38% of the clustering sample is noise, so many wallets stay unclassified.