A hybrid deep learning framework with attention mechanism for anti money laundering in cryptocurrenc

Abstract

Introduction

Black money is defined as earnings obtained through illegal means. Money laundering represents the income obtained as a result of crimes such as drug trafficking, arm smuggling, and human trafficking, as if obtained from legal sources [1, 2]. Money laundering is the root cause of many crimes that use illicit money. It is difficult to estimate the total amount of money laundered each year because of the illegal nature of the transactions. However, [3] states that the revenue obtained through money laundering is between 800 billion and 2 trillion dollars worldwide. Money laundering poses a significant threat to global financial system [4]. Anti Money Laundering (AML) guidelines have been established to prevent harm caused by this activity. To combat money laundering, the European Union adopted the “Fifth Money Laundering Directive (5AMLD).” This law obliges maintaining customer history, monitoring transactions, and reporting any suspicious transactions to money laundering [5]. With the emergence of cryptocurrencies, money laundering evolved technologically. Cryptocurrency is a digital payment system designed in a virtual environment (without a bank) to verify and secure monetary transactions using cryptographic methods. Unlike paper money and financial systems, cryptocurrencies have a decentralized structure. The decentralization of each cryptocurrency originates from the blockchain structure, which acts as a database. It has been reported that money laundering, a criminal crime, is carried out through the blockchain [6, 7]. A rule based system is a basic method employed for detecting money laundering. It consists of a series of conditions that analyze whether specific events have occurred or if certain thresholds have been surpassed, indicating a suspicious state. However, this technique also has several disadvantages. One of its major disadvantages is that it leads to a high false positive rate and requires experts to create rules [8]. Machine learning (ML) methods, on the other hand, overcome the challenge of rule based systems by extracting complex models from historical data and can reduce high false positive and false negative rates [9]. With the emergence of big data, deep learning techniques can be considered as a solution to prevent money laundering [10]. Whereas feature extraction is performed manually in ML methods, the features of the input data are learned automatically in Convolutional Neural Networks (CNN) and Long Short Term Memory (LSTM) [11]. Feature extraction plays a critical role in enhancing the performance of the proposed model and effectively analyzing the dynamic and complex nature of cryptocurrency transactions. Specifically, cryptocurrency transactions are often irregular, high dimensional, and contain time series data. When analyzed directly, such data can negatively impact both the learning process and the classification performance. Feature extraction allows the model to extract meaningful and summarized information from such complex, high dimensional data. The CNN

model was applied to f synthetic financial transaction data by Kute et al. [12]. In terms of accuracy and false negative rates, the proposed approach performed better than other machine learning techniques like Random Forest (RF), Support Vector Machine (SVM), and XGBoost. The Shapley Additive exPlanations (SHAP) method was used to make the model outputs easier to understand. The visual analysis of each feature’s contribution to the classification process was evaluated by anti-money laundering (AML) specialists. Rani et al. [13] suggested an LSTM-based model to detect and prevent money laundering. This model is designed to support the reporting of suspicious activity and the construction of client risk profiles. By modeling financial data as time series, it becomes possible to detect transaction patterns associated with money laundering. Bidirectional Long Short-Term Memory (BiLSTM) is a deep learning architecture that allows temporal dependencies to be learned from both forward and backward directions. The Attention Mechanism (AM) operates by modulating the contribution of hidden states within sequential representations, assigning greater emphasis to those deemed more informative [14]. In doing so, it reduces the impact of less relevant signals and directs the model’s focus toward features that carry stronger discriminative value. Consequently, the learning process becomes more efficient and the overall classification performance improves. Tang et al. [15] proposed the BiLSTM4DPS model to detect phishing scam accounts on the Ethereum network. This model is based on a BiLSTM architecture enhanced with an Attention Mechanism. In their study, features such as transaction amounts and transaction counts were used to analyze the account behavior. This model converts account transaction records into sequences to extract the temporal and latent patterns of transactions. By integrating AM with masking techniques, a classification model is constructed to identify fraudulent accounts. Jainish and Alwin [16] proposed a deep learning based approach for financial fraud detection. The accuracy of fraud detection is improved by using Fisher score based feature selection and BiLSTM with AM. The model processes the data in matrix form to learn temporal dependencies and then focuses on important data through AM. A model for identifying unusual patterns in blockchain transactions was proposed by Wang et al. [17]. In this model, an inception structure was added to the CNN architecture to facilitate the learning of various patterns. To better account for the interactions among learned representations, a self-attention component was incorporated into the architecture, with the aim of refining overall model performance. Although deep learning approaches have shown promise in the detection of money laundering, many existing implementations remain limited in their ability to represent the structural complexity and evolving dynamics of cryptocurrency transactions. Addressing this gap, the present work develops a hybrid CNN–BiLSTM–AM architecture that integrates convolutional feature extraction,

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

bidirectional sequence modeling, and an attention mechanism within a unified framework. In this model, the extraction of local features using CNN and the extraction of sequence features using BiLSTM were combined. AM is then used to dynamically evaluate the importance of each feature in the sample input. The novelty of this study lies in the combination of deep learning techniques and AM to improve the detection of illegal cryptocurrency transactions. Graph based algorithms for AML detection were typically employed in earlier research. This study fills this gap in the literature by showing how deep learning can be effectively used in challenging areas, such as the detection of illegal activities. The main contributions of this study are summarized as follows: • In this study, after testing various models, including CNN, LSTM, BiLSTM, and their combinations, the CNN-BiLSTM-AM hybrid model is proposed. This model is designed to detect illegal money transfers and is enhanced by the AM. • The hybrid model was tested on the Elliptic dataset and achieved superior results compared to existing methods in the literature. • ·This study indicates that incorporating AM can meaningfully support AML efforts. These results offer insightful direction for further studies meant to reduce the dangers connected to the increasing use of cryptocurrencies. The structure of this paper is as follows. Section 2 reviews previous studies and methods using an Elliptic dataset. Section 3 discusses the dataset, working principles, and the architecture of the proposed model. The functionality and interactions of each component of the model are described. Section 4 explains the model setup designed in this study and provides the experimental results and performance metrics. A comparison was conducted between the proposed model and alternative methods using an Elliptic dataset. Section 5 provides a discussion of the findings, implications, and limitations of this study. Finally, Section 6 summarizes the key findings of this study.

based on different learning strategies are included in GNN architectures. These consist of the Graph Isomorphism Network (GIN), Graph Attention Network (GAT), Graph Convolutional Network (GCN), and GraphSAGE. GCN is a deep learning model used to recognize and predict patterns on graph based data structures. GCN is a structure adapted to graph data structures based on a CNN. First, Weber et al. [18] proposed an Elliptic dataset in their study and divided the dataset into 70% training and 30% test sets to detect illegal Bitcoin transactions. They used a GCN, Logistic Regression (LR), RF, and Multilayer Perceptron (MLP) to evaluate the dataset and perform binary classification. The results were compared for precision, sensitivity, and F1 score. The RF technique achieved precision, sensitivity, and F1 score of 0.95, 0.67, and 0.78, respectively. Alarab et al. [19] presented a new approach based on MLP and GCN to predict illegal transactions on the Elliptic dataset. In the proposed method, they obtained the result that the hidden representation of GCN derived features and a linear layer increased the performance of the model according to the study [18]. GAT is a deep learning model used to model the relationships between nodes in graph structured data. Pocher et al. [20] used the GCN and GAT methods. This is the first time that GAT has been applied to detect anomalies in Bitcoin. Their results showed that the GCN yielded better results than the GAT. GraphSAGE is a method used for node embedding learning in large scale graphs. Chen et al. [21] proposed a GraphSAGE model that can detect target node features from neighboring features and their time series features. They aimed to detect whether the target node was anomalous to its neighboring nodes. For this purpose, they computed the similarities between the features of neighboring nodes. They also used GraphSAGE to combine the features of neighboring nodes. Deep Graph Infomax (DGI) and GIN are two different GNN methods used for modeling graph data. Lo et al. [22] proposed Inspection-L, a self supervised GNN framework based on DGI and GIN. DGI is a general unsupervised learning approach for acquiring node representations in data with graph structure. The proposed Inspection-L method is based on the combined use of RF and DGI to detect illegal transactions. Additionally, the proposed model allows each node to access all graph structural models by capturing neighborhood information. They used the DGI along with the recommended GIN to learn node placements. Node placements were then evaluated using the RF algorithm for the training and test sets. Deep learning is an effective tool for solving complex and multidimensional problems such as detecting and preventing money laundering. To address the spatiotemporal complexity of money laundering transactions, Wan and Li [23] proposed a deep learning based prediction model called MDGC-LSTM. The model aims to capture multilayer relationships within transaction data by combining a Dynamic Graph Convolutional Network and LSTM network. It achieved a 25% higher Macro-F1 score compared to the best existing models on the Elliptic dataset. Yang et

Literature Review

Recently, research in the field of AML has incorporated graph based algorithms and ML. In this section, a summary of the work conducted for AML using an Elliptic dataset is provided. One kind of neural network intended for handling and evaluating graph-structured data is the Graph Neural Network (GNN). GNN are capable of handling dynamic structures made up of nodes and edges, whereas traditional neural networks usually work with fixed and regular data structures. GNN are able to model the structural relationships and connectivity patterns of a graph by learning the features of its nodes and edges through the use of neighborhood information. A vast variety of models

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

al. [24] proposed two methods to solve AML problems. The first method combines the LSTM-GCN algorithms, and the second method uses ensemble learning. A multilabel classification model is trained using the LSTM-GCN algorithm, which improves the detection accuracy of illegal transactions. In the second method, multiple models are trained to identify and separate the illegal transaction data. Xia et al. [25] proposed a hybrid spatiotemporal prediction model based on GCN and LSTM, called MGC-LSTM. Elliptic dataset is a structure consisting of 49 different time steps. The 49 time steps were learned independently and the output of the previous step served as the input for the next step. LSTM was used to obtain the temporal dependence of the dataset, and GCN was used to learn the spatial dependence of its processes. The results trained by the LSTM were provided as inputs to the GCN. Xiao et al. [26] presented a novel method for tuning GCN network parameters, called CTDM, which integrates EvolveGCN with Minimal Gated Unit (MGU). MGU was developed as an alternative to LSTM cells. MGU uses fewer input gates than LSTM cells. In addition, MGU offers a simpler structure by directly applying an additional logistic value to the memory cell and the forget gate. CTDM uses the MGU to improve the parameters of the GCN and requires fewer learning parameters through the MGU. Guo et al. [27] proposed LB-GLAT to capture the topological structure and attribute features of money laundering. LB-GLAT was designed to successfully identify the target of blockchain transactions using a transaction graph and an inverse transaction graph. The problem of over smoothing was reduced using a long term layer attention mechanism. They obtained an accuracy of 97.0%, precision of 93.0%, recall of 84.0%, F1-score of 88.87% and AUC performance of 0.98. Wang et al. [28] proposed the RMGANets method to overcome the limitations of GCN. This method is a reinforcement learning based approach that incorporates multi relational attention graph awareness. In their study, they constructed a large multi relational graph that includes transactions, addresses, users, and cash flows as nodes. Reinforcement learning was utilized to complete the missing node information caused by masking operations and to emphasize the differences between the various types of nodes. Label scarcity refers to the fact that not all or some examples in the training dataset have class labels. Lorenz et al. [9] studied the lack of labels in an Elliptic dataset. In the dataset, 21% of Bitcoin transactions are labeled as legal and 2% as illegal. The remaining transactions do not contain tag data. The number of labels was increased using Active Learning to improve the performance of unsupervised learning. The classification was performed using XGBoost (76%), LR (45%), and RF (83%). Despite employing a distinct approach to address this issue, the authors did not intend to achieve superior outcomes. Monte Carlo dropout (MC-dropout) is a method used in uncertainty estimation for ML and especially deep learning models. This method is related to a technique known as dropout, which is used

to organize a network during learning. Alarab et al. [29] and Alarab and Prakoonwit [30] applied the MC-Dropout method in their studies. In [30], an active learning framework for analyzing the Bitcoin dataset was introduced. They used active learning called Monte-Carlo Dropout (MC-Dropout) and Monte-Carlo Based Adversarial Attack (MC-AA) to calculate uncertainties. They later proposed a temporal-GCN by combining LSTM and GCN models. The results showed that they achieved an accuracy of 97.7%. Jatoth et al. [31] analyzed feature selection to improve classification. The purpose of feature selection is to select fewer or more appropriate features in order to obtain a better model. They applied ensemble and classical supervised learning methods to classify the legal and illegal transactions. Consequently, they achieved better results in community learning models. A review of AML studies highlights the increasing complexity of money laundering methods and the significant challenges posed by the anonymity of virtual currency transactions to existing methods. The lack of labeled data makes this problem worse and restricts the effectiveness of supervised learning-based models [23]. A range of methods such as GCN, LSTM, and various hybrid or graphbased architectures has been examined in prior research. However, these models often have limited scalability, interpretability, and adaptability to the dynamic nature of cryptocurrency transactions. This study proposes a novel hybrid model that combines CNN, BiLSTM, and an AM in order to get around these limitations. The attention component directs the model toward the most salient features during classification, combining convolutional feature extraction and bidirectional temporal modeling instead of depending on a single modeling paradigm. By effectively learning both temporal dependencies and structural relationships, the proposed model aims to increase the reliability and accuracy of illicit transaction detection. This method shows a strong performance on complex and large datasets by addressing the shortcomings of previous approaches. This study contributes a significant innovation to the AML field by filling critical gaps in the literature.

Material And Methods

In this section, the dataset used in this study is described. An overview of the existing CNN, BiLSTM, and AM approaches utilized to perform the work is then provided. Finally, the proposed method is described. Dataset Elliptic dataset used in this study is a Bitcoin graph, where nodes represent transactions and edges represent flows between transactions [18]. This dataset is recognized as one of the most extensively labeled datasets available for cryptocurrencies [32]. It comprises 49 graph structures sampled from the Bitcoin blockchain at various time

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

intervals. The dataset consists of 203,769 node processes and 234,355 edges. Each transaction is divided into three classes: legal (e.g., wallet providers, exchanges, legitimate services, and miners), illegal (e.g., terrorist organizations, ransomware, and Ponzi schemes), and unknown. Of the total number of transactions, 2% (4,545) were labeled as illegal and 21% (42,019) as legal. The remaining 77% (157,205) as unknown. The dataset comprises 166 features, with the first 94 features relating to transaction specific information, such as input number, output number, transaction fee, and time step. The remaining 72 features relate to the aggregate information about the direct neighbors of the process, providing the correlation coefficient, standard deviation, and maximum and minimum values of each process.

of parameters that must be learned, easing computational requirements while also mitigating the tendency toward overfitting. Once the feature representations have been smoothed in this way, they are passed to fully connected layers, where they are processed within a conventional neural network structure for final classification or prediction. These layers ultimately generate the final outputs by leveraging the features learned by the CNN in earlier stages.

Convolutional Neural Networks CNN is a widely utilized artificial neural network architecture within the domain of deep learning [33]. It uses special layers such as convolution and pooling to understand the structure and properties of data. CNN is composed of convolution, activation, pooling, and fully connected layers [34]. The convolution layers enable the generation of feature maps by applying sliding filters over the input data [35]. These feature maps represent different attributes of the input data. Activation layers apply a specific activation function to each generated feature map.. This activation function emphasizes or suppresses the significance of certain features in each feature map based on weights. Pooling layers were used to decrease the dimensions of the feature maps [36]. In practice, pooling operations rely on maximum or average sampling strategies to condense the feature maps. This reduction in dimensionality lowers the number

Bidirectional Long Short Term Memory Recurrent Neural Networks (RNN) are deep learning models that operate based on prior knowledge of data [37]. The basic component of RNN is their cell structure. The cells process the inputs and previous outputs while maintaining their internal states. The RNN uses these cells at each time step, and the outputs of these cells are provided as inputs for the next step. Feedback algorithms are another important component of RNN. This algorithm identifies the source of the error and optimizes network parameters. Feedback is important to reduce errors during network training. Another RNN variation is the LSTM network [38]. LSTM uses sequential data as the input and makes predictions by remembering the information held at the previous time steps. Thus, LSTM is highly successful at processing complex sequential data. The LSTM cell consists of a mechanism comprising a forget, input gates, output gates, and cell state. Figure 1 shows the LSTM structure. Forget gate in a RNN is responsible for determining which information from the previous hidden layer and current input will be retained or forgotten. This is achieved by passing the combined information from the previous hidden layer and current input through a sigmoid function.

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

Information from the input. Xt and the previous output ht−1 are passed through the sigmoid function. The sigmoid function outputs a value between 0 and 1, where a value close to 0 indicates that the information will be largely forgotten and a value close to 1 indicates that the information will be retained. The forget gate [39, 40] ft is given by Equation 1.

through the tanh function. The output of the tanh function and the result of the sigmoid function were multiplied. The resulting value goes to the next layer as the “previous value.” Equation 5 shows the output cell state ot and Equation 6 shows the output value ht [39, 40].

(1) Input gate is used to update the cell state. First, a sigmoid function is applied, and the information that will be retained is determined. The output of the sigmoid function is reduced between -1 and 1 using the tanh function. This process normalizes the output of the cell and helps the network operate more stably. The cell state was updated by multiplying the two values obtained. This new memory was added to the Ct−1 memory to obtain the Ct. In Equation 2, the sigmoid function, and in Equation 3, the tanh function steps are given. (2) (3) The most important task for the Cell State in a cell is to carry information. It receives data that must be passed on to the end of the cell, and then to other cells. First, the Forget Gate output was multiplied by the output of the previous layer. Next, it is added to the value from the input gate. These operations update the state of the cell and allow relevant information to be transmitted to the next cell. The new cell state [39, 40] Ct is given by Equation 4. (4) Output Gate determines the value to be sent to the next layer. This value was used for the prediction. At this stage, the previous output (value) and the current input are fed into a third sigmoid function. The Cell State value passes

(5) (6) BiLSTM is an improved version of the LSTM algorithm [41]. Although the LSTM architecture is unidirectional, the BiLSTM architecture is bidirectional. BiLSTM consists of two LSTM layers: one processing the input in the forward direction, and the other in the backward direction. LSTM can make predictions using historical data, whereas BiLSTM can make predictions using historical and future data. BiLSTM network structure consists of four layers: Input Layer, Forward Layer, Backward Layer and Output Layer. Figure 2 shows the structure of the BiLSTM. In BiLSTM, the input data sequence (xt−1, xt, xt+1) is used as the input for both forward and backward LSTM. At each step t, the forward LSTM hidden state ( ) and backward LSTM hidden state ( ) were calculated simultaneously. The output ht of the BiLSTM is calculated using both and information. Equations [7-9] calculate the values of , and ht [42]. (7) (8) (9)

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

Softmax is commonly used to calculate attention weights. The sum of these weights, which have values ranging from 0 to 1, is 1. This property allows the mechanism to evaluate different input features systematically and assign stronger importance to those most relevant to the decision-making process. Context vector (c): Context vector enables the model to focus on the input elements that are considered more important. Critical information in the data can be more effectively represented in this way. The context vector is obtained by combining the input elements weighted by their corresponding attention weights [46]. (12)

Attention Mechanism AM refers to a mechanism in deep learning models that allows them to focus on a particular input [43]. This makes the model better able to perform a particular task, and helps it use fewer computational resources. As shown in Figure 3, the AM computational process consists of three stages.

1. Attention score (st): The similarity or relationship

between input and output features is measured by the attention score. The model uses this score to decide which input features to prioritize. Thus, the attention score emphasizes which input features are more important to the model when generating the output. The attention score [44] is calculated using Equation 10.

Proposed Model In this study, the CNN-BiLSTM-AM model is proposed, which combines the features of CNN, BiLSTM, and AM to detect licit and illicit transactions in the Elliptic dataset. The structure of the CNN-BiLSTM-AM model is illustrated in Figure 4. This model consists of the input layer, CNN layer, BiLSTM layer, AM layer and output layer. In the following, each block of the proposed method is described in detail:

(10) Where Wh, ht and bh are the weight, input vector and deviation of the AM, respectively. Attention scores determine which input items the model prioritizes, allowing the model to focus on its resources. Inputs associated with lower attention scores are treated as less influential, whereas those with higher scores receive greater emphasis during processing. This enables the model to concentrate on salient information while minimizing the impact of irrelevant, noisy, or redundant inputs.

2. Attention weight (at): Indicates the importance of

a particular input item or component, and the attention weight value is calculated using Equation 11 [45]. (11)

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

Input Layer represents the data of cryptocurrency transactions. The data is expressed as time series and is represented as (Xt−1, Xt and Xt+1 ) over a specific time period. CNN is utilized to extract features from the time series data. To extract important features from the input data, sliding filters are applied. The features taken from the CNN layer are further summarized using MaxPooling. BiLSTM is employed to capture the sequential dependencies in the time series data. The outputs at each time step (t−1, t+1) are processed based on both past and future information. and represent the hidden states processed in the forward and backward directions, respectively. The goal of this bidirectional processing is to record the data’s context in both directions. Attention Layer added to the end of the BiLSTM block, this layer assigns different weights to hidden states that contribute differently to the cryptocurrency transactions. This makes it easier to create a high level vector that compiles all pertinent data. Output Layer flattens the context vectors that the AM produced into a single vector. The final classification is then carried out by one or more fully connected layers using this flattened vector as input. The parameters of the methods used in the model are provided in Table 1.

outcomes was utilized by using the k-fold cross-validation technique. This method involves dividing the dataset into k parts, with each part serving as the test set in a rotation. The remaining data were used to train the model. This process was repeated by creating different combinations of the training and test sets in each cycle. Consequently, the model’s performance consistency across various data splits was assessed more reliably. In this study, k is set to 10. The dataset was divided into ten equal parts, and one part was reserved as the test data. The nine parts that remained were trained. The test data was used to assess the models’ performance. Of the total number of transactions, 21% (42,019) are labeled legal, 2% (4,545) are labeled illegal, and the remaining 77% (157,205) are unknown. The dataset’s imbalance was addressed using the Synthetic Minority Oversampling Technique (SMOTE) [47]. By reproducing the samples from the minority class, SMOTE balances the dataset. The SMOTE process includes the following steps:

3. Using this vector to generate new instances, synthetic

instances with similarities to the original instance are generated.

4. New synthetic instances are added as part of the original

minority class. SMOTE method was used for k-fold cross validation, where the dataset was balanced at each of the k-folds, and k-fold cross validation was performed on the dataset at each fold separately. This approach ensured that the model at each stage was trained on balanced data. Performance of the hybrid method was then evaluated using accuracy, sensitivity, precision, and F1-score metrics. These values were calculated using Equation 13–16. Performance metrics were obtained from the confusion matrix presented in Table 2. In the confusion matrix, True Positive (TP) represents an illicit instance accurately identified as illicit. False Positive (FP) refers to a licit instance mistakenly classified as illicit. False Negative (FN) denotes an illicit instance incorrectly identified as licit, while True Negative (TN) represents a licit instance correctly identified as a licit. Accuracy, precision, recall, and F1-score were obtained using the confusion matrix.

Experimental Results

In this section, the performance results of the CNNBiLSTM-AM hybrid method applied to the Elliptic datasets used in this study are presented and compared with other studies. The impact of random data splits on performance

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

The CNN-BiLSTM-AM model delivered the top performance in precision, recall, and F1-score, with values of 99%, 98%, and 98%, respectively, as shown in Table 4 Additionally, an accuracy of 97.9% was obtained, representing the second-highest result in the comparison. Although the Ensemble (Boosting-CFS) method [31] reported the highest overall accuracy, the CNNBiLSTM-AM model achieved stronger precision, recall, and F1-score values, indicating a more balanced classification of both positive and negative classes.. Although the LB-GLAT method [27] showed 97.76% accuracy, the proposed model exceeded this success with 99.0% accuracy. GCN + MLP [19] and Temporal-GCN [30], which are among the graph based methods, achieved results close to those of the proposed model with 97.4% and 97.7% accuracy values, respectively. While RMGANets [28] has high performance in accuracy 97.96%, the CNNBiLSTM-AM model still achieves a higher overall balance between all metrics, confirming its better performance in classifying both positive and negative instances. These results demonstrate the superiority of the AM and hybrid architecture of the proposed model for understanding complex data structures. In general, it is observed that the proposed model achieves more effective results than the methods in the literature.

(13) Precision: The proportion of true positives among the samples predicted as positive. This value measures the success of the correct predictions. (14) Recall: The metric shows the number of values that need to be estimated as positive and are correctly estimated as positive. If this value is extremely low, illicit transactions cannot be detected effectively. (15) F1 Score: The harmonic mean of the precision and recall values. (16) Table 3 shows the comparison of the proposed hybrid model with other standalone deep learning methods. CNN is effective in capturing local patterns within the data. BiLSTM is unique in its ability to comprehend relationships that change over time. Together, these two models allow for the simultaneous learning of the temporal dependencies and structural features in the data. By enabling the model to concentrate on the most crucial aspects of the data, the AM further improves the classification accuracy. This feature offers a significant benefit, particularly given the dynamic nature of cryptocurrency transactions. AM enables the model to discard irrelevant data and focus only on meaningful patterns. The proposed model in this study has a structure that enhances the performance of each of the CNN, BiLSTM, and hybrid methods.

Discussion

In this study, the CNN-BiLSTM-AM hybrid model developed to detect illicit money transfers was tested on the Elliptic dataset. With a precision of 97.62%, the CNN model exhibited a high level of ability to extract features from raw data; however, its recall remained at 91.09%. With a recall of 90.18% and a relatively low precision of 86.49%, the BiLSTM model successfully captured the temporal dependencies in the sequential data. The CNN-BiLSTM model achieved a high precision of 98.7% by combining the advantages of both methods; however, its recall was only 64.4%. In contrast, the proposed CNN-BiLSTM-AM model, which was improved by incorporating the AM, performed better and more

Tablo 3. Performance comparison of proposed hybrid model and standalone methods

Bi̇lstm

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

Table 4. The comparison results of CNN+BiLSTM-AM and other methods on elliptic dataset Reference

Lb-Glat

evenly, achieving 97.9% F1-score, 98.0% precision, and 98.0% recall. When considered in relation to earlier studies, these results suggest performance at a state-ofthe-art level. Class imbalance was handled through the application of SMOTE within each fold of the cross-validation process, so that resampling was confined to the training data in every iteration. Embedding this step directly into the validation procedure helped prevent inflated performance estimates and supported a more stable assessment across folds. In this sense, the resulting performance patterns suggest that the model behaves consistently under both conceptual expectations and practical data conditions. The empirical results show that the CNN–BiLSTM– AM framework maintains stable performance in identifying illicit cryptocurrency transactions, without introducing excessive computational burden. Rather than functioning solely as a high-performing predictive model, the framework also provides insight into how attention mechanisms interact with temporal and structural features in complex classification settings. Future research aimed at better understanding and reducing the risks associated with the growing adoption of cryptocurrencies is anticipated to be guided by this study’s findings.

Conclusion

Cryptocurrencies represent technological advancements that have significantly altered the financial systems of nations. However, this transformation has also contributed

to an increase in illicit activities in the financial domain. In particular, money laundering, terrorist financing, and similar crimes have become more serious threats as cryptocurrencies have been adopted more widely. Consequently, AML in cryptocurrency systems has become a priority issue in the financial sector. In this context, increasing transaction transparency is important. In addition, regulatory policies and compliance mechanisms aimed at strengthening identity verification processes must be developed. Artificial intelligence-based methods are considered effective tools for detecting suspicious transactions and money laundering activities. This study introduces a method for identifying illegal activities within cryptocurrency transactions. At the same time, the study is intended to offer practical insight into addressing financial crime. The model developed in this study may serve as a reference structure for financial institutions seeking to strengthen their AML strategies. Given its compatibility with blockchain based environments, it also points to possible improvements in transparency and operational security within financial systems. These results are expected to shed light on future research that aims to meet the growing needs of the financial ecosystem and create a safer digital environment from ethical, societal, and economic perspectives. The findings suggest that the proposed model is not only technically robust but also practically viable for detecting illicit activity. Nevertheless, evaluating its performance across diverse datasets remains important for assessing generalizability, particularly in view of constraints related

Sigma J Eng Nat Sci, Vol. 44, No. 2, pp. 970−982, April, 2026

to dataset size and structural characteristics. Further investigation is needed to analyze optimization strategies and computational requirements more systematically, particularly in assessing the practicality of real-time deployment. Against the backdrop of the growing transformation of Bitcoin within the financial ecosystem, this study explores how deep learning techniques can be applied to the detection of illicit activities. The CNN-BiLSTM-AM hybrid model developed in this study offers a novel approach for achieving this goal. As a result of the experiments on the elliptic dataset, it was observed that the model performed better than the other methods in the literature. The results indicate that deep learning techniques can be effective tools in the fight against AML and can make a significant contribution to combating financial crimes. It is also believed that this study will inspire further research and development efforts to understand and address the risks associated with the increasing use of cryptocurrencies.

Share and Cite