
Blockchain transaction data exhibit heterogeneous structures, complex interactions, and highly imbalanced distributions, which pose significant challenges for unsupervised anomaly detection. Existing methods often fail to effectively model the intrinsic feature distributions of normal transactions and typically lack interpretability, limiting their reliability and usability in practical blockchain scenarios. To address these issues, this paper proposes an unsupervised anomaly detection framework based on feature distribution learning. The core idea is to explicitly model the distribution of normal transaction behavior in a compact latent space while preserving interpretability. Specifically, a Kolmogorov–Arnold Network (KAN) is employed to learn a two-dimensional latent representation of blockchain transactions, capturing nonlinear relationships between features. During training, the model minimizes the radius of a hypersphere enclosing normal samples, encouraging a compact and structured distribution. During inference, anomalies are identified based on their geometric deviation from the learned distribution, measured by the distance to the latent-space center. This design avoids reliance on reconstruction errors and enables a more direct and stable decision mechanism. Experiments on Ethereum, Blockchain Network Attack Traffic dataset (BNaT) and Real World Dataset of Cryptocurrency Addresses with Transaction Profiles (Real-CATS) demonstrate that the proposed method consistently outperforms state-of-the-art unsupervised baselines across multiple metrics. Furthermore, the symbolic expressions derived from the learned mapping reveal key transaction features that drive anomaly detection decisions, providing clear interpretability. These results highlight the effectiveness, robustness, and practical value of feature distribution learning for blockchain anomaly detection.
blockchain; anomaly detection; unsupervised learning; Kolmogorov–Arnold Network; feature distribution learning; interpretability