  Bitcoin has been subject to illicit activities more often than probably any
other financial assets, due to the pseudo-anonymous nature of its transacting
entities. An ideal detection model is expected to achieve all the three
properties of (I) early detection, (II) good interpretability, and (III)
versatility for various illicit activities. However, existing solutions cannot
meet all these requirements, as most of them heavily rely on deep learning
without satisfying interpretability and are only available for retrospective
analysis of a specific illicit type.
  First, we present asset transfer paths, which aim to describe addresses'
early characteristics. Next, with a decision tree based strategy for feature
selection and segmentation, we split the entire observation period into
different segments and encode each as a segment vector. After clustering all
these segment vectors, we get the global status vectors, essentially the basic
unit to describe the whole intention. Finally, a hierarchical self-attention
predictor predicts the label for the given address in real time. A survival
module tells the predictor when to stop and proposes the status sequence,
namely intention. %
  With the type-dependent selection strategy and global status vectors, our
model can be applied to detect various illicit activities with strong
interpretability. The well-designed predictor and particular loss functions
strengthen the model's prediction speed and interpretability one step further.
Extensive experiments on three real-world datasets show that our proposed
algorithm outperforms state-of-the-art methods. Besides, additional case
studies justify our model can not only explain existing illicit patterns but
can also find new suspicious characters.
