ML that earns its way into the verdict: supervised β-scores, honest anomaly meters, and a false-positive purge

Plenty of products put ML into risk verdicts. Few can answer the question: was that model validated on production data? Starting today, ChainAnalyzer shows you the validation process itself.

Supervised ML as a β display — visible, but not in your score

Every scan's detection list now includes the supervised ML model's fraud-probability estimate as a β reference (the purple β CRITICAL badge). The important part: this value contributes zero points to the risk score.

The model is in shadow evaluation. It joins the verdict only after passing multiple quality gates measured on production traffic. We don't ship "the offline metrics looked good" — earning a place in the score requires proof on production data. Until then, the β display lets you watch what the model is thinking.

An honest reframe of the anomaly meter

The unsupervised "ML Anomaly" meter has been redefined as a novelty indicator ("this behaves unlike most addresses") and no longer contributes to the risk score. Our production measurements confirmed that anomaly and malice are different things — on every chain, the statistically most "anomalous" actors are legitimate high-throughput infrastructure: exchanges and issuers. Anomaly detection keeps its value as a novel-pattern discovery tool; the shortcut "anomalous therefore dangerous" is gone. The meter now carries a "reference" badge.

A false-positive purge for legitimate infrastructure

Alongside, a precision sweep across the detection pipeline. The principle: distinguish "high activity" from "malicious":

• Graph proximity now considers direction of funds — sending to a bad address (possible victim) is treated differently from receiving from one (possible downstream)
• Contract monitoring of major legitimate tokens (e.g. USDT) no longer flags large transfers mechanically — contact detection against known-malicious addresses stays fully active
• Fake-token transfers (Unicode spoofing) are excluded from graph evidence — closing the loophole where an attacker could make anyone look risky by airdropping them counterfeit tokens

A newly discovered address-poisoning network cluster was added to ScamDB during this work and is queryable via the public API.