A multi-source empirical audit of blockchain and DeFi: concentration, intelligent agents, and mechanism design

1 Introduction

Decentralized finance (DeFi) has evolved from a fringe experiment into a global economic infrastructure in which thousands of autonomous protocols manage capital, allocate credit, and coordinate both human and, increasingly, artificial agents without centralized intermediaries. Yahia et al. (2026) document the rapid growth of research at the intersection of artificial intelligence and crypto-assets, arguing that this convergence raises questions that no single discipline can answer in isolation: How is economic power distributed in a system designed to be decentralized? Can malicious behavior be detected without a central authority responsible for auditing it? What guarantees that a protocol’s rules will produce the aggregate behavior anticipated by its designers? These questions correspond to the three analytical pillars that structure this study: Economic Systems, Intelligent Agents, and Mechanism Design.

The scale of this ecosystem extends beyond its technological dimension and directly challenges the reliability of the indicators used to measure and regulate it. Luo et al. (2026) argue that Total Value Locked (TVL), the most widely adopted metric for quantifying the sector, can obscure more than it reveals by combining assets held in centralized exchanges with genuinely decentralized activity into a single aggregate measure. From the perspective of behavioral risk, Elmougy and Liu (2023) show that a non-trivial fraction of activity on public blockchains such as Bitcoin involves illicit behavior that cannot be reliably identified without machine learning techniques capable of exploiting transaction-graph information while providing interpretable predictions. Regarding mechanism design, Qian et al. (2025) demonstrate that a substantial proportion of the multi-million-dollar losses experienced by DeFi protocols arise not from isolated software defects but from interactions between economic parameters and agent behavior that protocol designers failed to anticipate. Collectively, these findings describe an ecosystem whose complexity is increasing faster than the discipline’s ability to measure, audit, and explain it with the level of rigor expected in traditional financial markets.

This study addresses that challenge through an empirical analysis integrating five publicly available data sources: Uniswap decentralization indices, the Elliptic Bitcoin dataset, a multi-year sample of ERC-20 trading activity, Bitcoin incentive series, and DeFiLlama TVL data. The Elliptic, ERC-20, Bitcoin, and DeFiLlama sources were audited and canonicalized directly, whereas the Uniswap indices were adopted as precomputed daily decentralization series published by Chemaya et al. (2025) and then analyzed within the same cross-pillar framework. Nguyen Thanh et al. (2024) suggest that blockchain may become the economic infrastructure supporting autonomous agents. Rather than relying on theoretical projections, this study evaluates real-world evidence to determine whether the current ecosystem already exhibits patterns of concentration, risk, and mechanism design consistent with that vision or whether significant gaps remain that have not yet been quantified within a unified empirical framework. This evaluation is supported by a reproducible audit protocol for four primary sources and by an explicitly documented harmonization step for the adopted Uniswap-derived indices.

The remainder of this article is organized as follows. Section 2 reviews the literature supporting the three analytical pillars. Section 3 describes the materials, datasets, and methodology. Section 4 presents the empirical results organized according to the proposed framework, and Section 5 discusses the findings, outlines the study’s limitations, and concludes the article.

2 Literature review

The convergence of blockchain, decentralized finance (DeFi), and artificial intelligence (AI) has transformed the nature of digital economic systems, giving rise to markets in which capital concentration, agent behavior, and protocol rules are inherently interconnected. Yahia et al. (2026) document, through a systematic bibliometric review, the rapid growth of research at the intersection of artificial intelligence and crypto-assets, whereas AlQudah and Bariviera (2026) show that regulatory approaches remain fragmented across jurisdictions. In parallel, Nguyen Thanh et al. (2024) argue that blockchain may evolve into the economic infrastructure supporting autonomous AI agents, and Gürpinar (2025) extends this perspective to decentralized coordination architectures for Web 4.0. Collectively, these studies converge on the same conclusion: economic systems, agent behavior, and mechanism design cannot be understood in isolation, yet they are rarely examined jointly within a unified and empirically verifiable framework.

Within the Economic Systems pillar, Chemaya et al. (2025) construct Gini, Herfindahl–Hirschman, Nakamoto decentralization, and entropy indices for Uniswap trading volume across networks, whereas Celig et al. (2025) document a near-maximal concentration of wealth in the Ether supply. However, both studies characterize concentration within a single layer of the ecosystem without comparing it with aggregate capital concentration across protocols. Moreover, Luo et al. (2026) question the validity of TVL as an aggregate indicator, arguing that it combines assets held in centralized custody with native DeFi activity into a single metric.

Within the Intelligent Agents pillar, Asiri and Somasundaram (2025) and Elmougy and Liu (2023) demonstrate that Bitcoin transaction patterns enable the discrimination of legitimate and illicit behavior using graph-based learning methods. Ertam (2025) and Wang et al. (2024) show that SHAP–based explainability attributes this predictive capability to specific input features. However, none of these studies explicitly distinguishes the contribution of transaction-level attributes from that of neighborhood–level information. Finally, within the Mechanism Design pillar, Feng et al. (2024) model overcollateralization as a stability mechanism in stablecoin protocols, and Tang et al. (2024) develop a real-time system for discovering blockchain extractable value (MEV) as a basis for optimizing DeFi protocol parameters. Nevertheless, the literature rarely extends this type of protocol-parameter analysis to the utilization dynamics of lending platforms such as Aave and Compound, nor does it compare them with the incentive structure of a long-term system such as Bitcoin.

This fragmentation reveals a clear research gap: the absence of a unified study integrating economic concentration at both the network and ecosystem levels, explainable detection of illicit behavior at the individual-agent level, and mechanism design across lending protocols and the Bitcoin network under a common audit and data-verification protocol. This gap is particularly relevant because Alhaidari et al. (2025) and Qian et al. (2025) show that many failures in DeFi mechanism design, including flash-loan attacks and oracle manipulation, emerge precisely from the interaction between economic parameters and agent behavior, which the literature typically analyzes independently. Furthermore, Soleimanof and Neufeld (2026) argue that the promise of decentralization should be empirically verified rather than assumed.

This study addresses that gap by integrating five publicly available data sources to evaluate concentration, model attribution, and protocol-level economic behavior within a single empirical audit framework. Its novelty lies in linking three usually separate layers of blockchain analysis: ecosystem-level concentration, transaction-level illicit-behavior detection, and lending-protocol/Bitcoin mechanism design. Rather than proposing a new dataset or predictive model, the principal contribution is a reproducible, cross-source audit and analysis protocol that treats Economic Systems, Intelligent Agents, and Mechanism Design as a unified, empirically verifiable object of study, while keeping the interpretation of observational results distinct from causal claims.

3 Materials and methods

The methodological framework integrates Uniswap decentralization indices, the Elliptic Bitcoin dataset, five sampled temporal periods constructed from the Harvard Dataverse ERC-20 Trading dataset, the Open Bitcoin Metrics series, and the DeFiLlama public API into a unified empirical framework organized around three conceptual pillars: Economic Systems, Intelligent Agents, and Mechanism Design. The audit, canonicalization, and metric-computation pipeline processed four primary sources, while the Uniswap source entered the analysis as published derived indices. Figure 1 illustrates the overall architecture of the proposed framework.

The RQ1–RQ8 labels in Figure 1 refer to the eight empirical tasks operationalized in the analysis: RQ1 evaluates network-level Uniswap decentralization indices; RQ2 measures protocol-level TVL concentration; RQ3 characterizes ERC-20 activity growth; RQ4 evaluates illicit-transaction classification; RQ5 analyzes SHAP feature-group attribution; RQ6 compares Aave V3 and Compound V3 borrowed-to-deposited ratios; RQ7 examines the Aave V3 oracle incident as an illustrative mechanism-risk case; and RQ8 evaluates Bitcoin miner-incentive and hash-rate series.

The four primary sources processed directly in the present pipeline underwent the same audit procedure before metric computation, while the Uniswap source was verified as an adopted derived-index dataset rather than recomputed from raw transactions. The audit began with a file inventory that recorded file size, extension, modification date, and a SHA-256 fingerprint calculated from the first megabyte of each file. This partial SHA-256 fingerprint was used as a preliminary identity check for duplicate file prefixes and was not treated as a full-file integrity checksum. Schema profiling then classified each column using blockchain-specific regular expressions into five categories: address/wallet, value/amount, time/block, transaction ID/hash, and token/protocol. Based on these categories, each file received a completeness score from 0 to 5 based on the number of categories represented. For tabular files exceeding 200 MB, specifically the January 2019, 2021, and 2024 snapshots of the ERC-20 dataset, an initial size estimate was obtained by dividing the decompressed file size by the average line length measured from a 20,000-line sample, avoiding a full scan for this preliminary inventory step. The reported ERC-20 row counts and unique-address/token counts were then obtained from a complete streaming pass over each selected snapshot file, in blocks of 500,000 rows using gzip decompression, during which every row was read and accumulated exactly; the earlier line-length sampling step was used only for preliminary inventory estimation and not for the reported Table 1 values.

TABLE 1. Evolution of ERC-20 trading activity across five sampled periods (2015–2024), counted exactly from a full pass over each snapshot file.

The audit also verified the actual correspondence between data values and the declared column order rather than assuming that the header accurately described the underlying data. This validation was performed through stratified sampling at four positions within each file (rows 0, 5,000,000, 15,000,000, and 30,000,000). The procedure identified a cyclical shift affecting the last six columns exclusively in the January 2024 ERC-20 file (202401.tsv.gz). Columns labeled as sender, recipient, and value actually contained the fields token_name, token_symbol, and token_decimals, whereas the latter three columns contained the corresponding transaction data. This hypothesis was independently validated using transactions associated with the USDC token (token_address = a0b86991c6218b36c1d19d4a2e9eb0ce3606eb48), whose decimal precision is publicly known and fixed at six decimal places. The column labeled value consistently contained the value 6, whereas the column labeled token_decimals contained plausible and variable transfer amounts, confirming the direction of the column shift. The correction was therefore implemented through explicit column remapping before any aggregation was performed. The remapping was applied exclusively to this file after the same stratified validation confirmed that the remaining four monthly snapshots preserved the column ordering specified in their headers. This column-order correction is reported explicitly because it has standalone reproducibility value for future analyses using the same ERC-20 Trading dataset.

3.1 Concentration and decentralization metrics for DeFi markets

Concentration was quantified using two distinct units of analysis: (i) precomputed daily Uniswap decentralization indices across four networks (Ethereum L1, Arbitrum, Optimism, and Polygon) over the common observation period available for each network (579, 488, 416, and 377 days, respectively, between June 2021 and December 2022); and (ii) the cross-sectional distribution of TVL across 5,724 protocols with positive TVL, selected from the 7,928 protocols reported by the DeFiLlama API (cutoff date: 2026-07-24). Protocols with zero or missing TVL (2,204) were excluded.

For the DeFiLlama protocol-level TVL distribution, the Gini coefficient was calculated using the absolute-difference formulation given in Equation 1:where x i denotes the TVL associated with protocol i, n is the number of protocols, and x ̄ is their mean. For computational efficiency, the coefficient was computed using the equivalent discrete integral of the Lorenz curve, thereby avoiding the n 2 direct pairwise comparisons.

G = ∑ i = 1 n ∑ j = 1 n | x i − x j | 2 n 2 x ̄ (1)

The Herfindahl–Hirschman Index (HHI) was calculated according to Equation 2:where s i = x i / ∑ j x j denotes the proportional TVL share of protocol i. For this cross-sectional TVL distribution, we computed Gini and HHI directly from the audited DeFiLlama snapshot.

H H I = ∑ i = 1 n s i 2 (2)

For the network-level Uniswap analysis, we did not recompute Gini, HHI, Nakamoto, or the entropy/diversity index from raw transaction records in this pipeline; we obtained them as precomputed daily series published by Chemaya et al. (2025). In those files, the Nakamoto coefficient is the minimum number of addresses required to exceed 51% of daily Uniswap transaction volume, HHI is reported on the conventional 0–10,000 source scale, and the entropy/diversity series corresponds to the source dataset’s effective Shannon diversity measure, D = 2 H, where H = − ∑ i p i ⁡ log 2 p i and p i is the daily transaction-volume share of address i. Therefore, the adopted source ‘Entropy’ column was interpreted as effective diversity, not as normalized Shannon entropy in bits.

The Kruskal–Wallis test, post hoc Mann–Whitney pairwise comparisons, the Mann–Whitney comparison of Aave V3 and Compound V3 utilization, and the Spearman correlation between utilization and deposit volatility used nonparametric tests given the bounded, right-skewed, or heavy-tailed distribution of the underlying concentration, utilization, and volatility series. Because several observations are temporally ordered and may exhibit serial dependence, these inferential tests are interpreted as descriptive distributional comparisons rather than as fully independent time-series inference. Ninety-five percent confidence intervals for headline point estimates were obtained by nonparametric bootstrap (10,000 resamples for the ratio estimates, 2,000 for the ecosystem-level Gini) or, for the Spearman correlations, via the Fisher z-transformation.

3.2 Characterization of ERC-20 trading activity

Five sampled temporal periods of the ERC-20 Trading dataset were analyzed, constructed from six compressed monthly files (November and December 2015, January 2017, January 2019, January 2021, and January 2024). Each monthly file was distributed by the original providers as an independent compressed snapshot. The largest files (520 MB–2.03 GB compressed) were processed in blocks of 500,000 rows, incrementally accumulating unique issuer, receiver, and token-contract addresses without loading the complete dataset into memory.

Each transaction was represented by the canonical tuple defined in Equation 3:where b i is the block number, h i is the transaction hash, τ i is the timestamp, a i is the token contract address, s i and r i denote the sender and receiver addresses, v i is the transferred amount expressed in the minimum token units, n i and y i correspond to the token name and symbol, respectively, and d i is the number of decimal places.

t i = ⟨ b i , h i , τ i , a i , s i , r i , v i , n i , y i , d i ⟩ (3)

The relative growth rate between two observation periods, t 1 and t 2, was computed using Equation 4:

g t 1 , t 2 = X t 2 − X t 1 X t 1 × 100 (4)

This expression was applied to both the total number of transactions and the number of unique issuing addresses to distinguish the intensive margin from the extensive margin of ecosystem growth.

3.3 Detection of illicit behavior and explainability

The Elliptic Bitcoin dataset contains 203,769 transactions distributed across 49 time steps. Each transaction is described by 167 attributes, including an identifier, the corresponding time step, 93 local transaction features, and 72 aggregated neighborhood features derived from one-hop neighbors. Among all transactions, 46,564 are labeled as legitimate or illicit, whereas the remaining 157,205 unlabeled transactions were excluded from supervised training and evaluation.

Following the temporal partitioning protocol proposed by Weber et al. (2019), transactions from time steps 1–34 (n = 29,894, 11.58 % illicit) were assigned to the training set, whereas transactions from time steps 35–49 (n = 16,670, 6.50 % illicit) were reserved for testing, thereby preventing information leakage from future observations into the training process.

A Random Forest classifier (200 trees, class_weight=”balanced_subsample”, random seed = 42) was trained using 165 predictive features. Model performance on the test set was evaluated using the precision and recall metrics defined in Equation 5.

P r e c i s i o n = T P T P + F P , R e c a l l = T P T P + F N (5)

The evaluation also included the F1-score, the area under the ROC curve (ROC-AUC), and the Average Precision (AP), corresponding to the area under the Precision–Recall curve.

Feature attribution was performed using SHAP values proposed by Lundberg and Lee (2017), computed with TreeExplainer from a random sample of 3,000 test transactions (seed = 42). The SHAP value associated with feature j for observation x is defined by Equation 6.where F denotes the complete feature set, S is a subset of features excluding feature j, and f x ( S ) represents the expected model prediction conditioned on the features contained in S. SHAP values were computed with TreeExplainer’s default tree_path_dependent feature-perturbation setting, which does not require a background dataset and estimates conditional expectations from the training-set coverage of each decision path. We computed mean absolute SHAP values for each of the 165 features, then aggregated them by feature group (93 local, 72 neighborhood) and reported them individually for the fifteen most influential features. Because feature groups are unequal in size, we compare group-level importance against the size-proportional null baseline of 93 / 165 = 56.4 % (local) and 72 / 165 = 43.6 % (neighborhood) rather than an implicit 50/50 split. Per-feature mean absolute SHAP was also computed as group attribution divided by the number of features in each group.

ϕ j f , x = ∑ S ⊆ F \ j | S | ! | F | − | S | − 1 ! | F | ! f x S ∪ j − f x S (6)

Algorithm 1 summarizes the complete training, evaluation, and explainability workflow.

Algorithm 1 Time Partitioning, Training, and SHAP Attribution for the Elliptic Dataset.

3.4 Mechanism design metrics for lending and bitcoin protocols

For Aave V3 and Compound V3, daily time series of deposited and borrowed TVL (chainTvls) were obtained through the DeFiLlama API for every blockchain on which each protocol operates. The values were subsequently aggregated across all supported chains to obtain a single daily time series for each protocol, computed by DeFiLlama as the sum of each protocol’s on-chain deposit and borrow balances across its supported markets, denominated in USD at each day’s closing price.

Aave V3 and Compound V3 differ not only in tunable economic parameters but also in market architecture. Aave V3 operates as a multi-asset pooled money market in which most listed assets can be simultaneously supplied and borrowed. In contrast, Compound V3 (Comet) is architected around a single borrowable base asset per deployment, with all other listed assets usable only as collateral.

The utilization ratio was calculated using Equation 7:

ρ t = T V L t borrowed T V L t deposited (7)

Monthly volatility was computed as the standard deviation of the daily percentage change in deposited TVL within each calendar month. Months with an average deposited TVL below USD 50 million (2 out of 101 protocol-months: Aave V3 in 2022–03 and Compound V3 in 2022–08) were excluded because they correspond to the initial deployment phase of newly launched chains, where denominators close to zero produce percentage variations that are not representative of the protocol’s economic performance.

For Bitcoin, six daily Open Bitcoin Metrics series (issuance, fees, total miner revenue, fee-to-revenue ratio, mining difficulty, and 7-day estimated hash rate) were analyzed over the 6,409 available daily observations (from 2009–01–01 to 2026–07–19). The proportion of miner revenue derived from transaction fees was computed according to Equation 8:where F t denotes the total transaction fees paid in BTC on day t, and I t represents the Bitcoin issuance (block subsidy) on the same day.

ϕ t = F t F t + I t (8)

4 Results

4.1 Dynamics of concentration and decentralization in DeFi markets

Before investigating how decentralization behaves within individual blockchain networks, it is first necessary to determine whether the DeFi ecosystem as a whole exhibits a genuinely decentralized distribution of capital or whether economic activity is instead concentrated among a small number of dominant protocols whose scale shapes the dynamics of the entire market. Table 2 addresses this question by summarizing the distribution of TVL across the principal categories of the DeFi ecosystem.

TABLE 2. Distribution of TVL across DeFi ecosystem categories (DeFiLlama snapshot: 2026–07–24; n = 5,724 protocols with TVL > 0).

The finding that a single custody category, CEX, accounts for 50.17 % of the aggregate TVL has methodological implications that extend beyond the observation of concentration alone. Across the 5,724 protocols with positive TVL, the protocol-level Gini coefficient is 0.985 (bootstrap 95% CI [0.977, 0.991], 2,000 resamples), while the HHI is 0.090, equivalent to approximately 901 on the conventional 0–10,000 scale. Excluding the CEX category leaves 5,647 non-CEX protocols. It yields a still very high Gini coefficient of 0.978 (bootstrap 95% CI [0.974, 0.982], 2,000 resamples), with a lower HHI of 0.020, equivalent to approximately 197 on the 0–10,000 scale. The literature frequently interprets this quantity as representing the growth of DeFi TVL; however, a substantial proportion of the reported capital corresponds to custody reserves held by centralized exchanges rather than to capital secured by non-custodial smart contracts. Consequently, the associated risk profile reflects counterparty and custodian risk instead of the smart-contract risk that characterizes decentralized finance protocols.

The apparently divergent Gini and HHI readings are not contradictory because they emphasize different aspects of the same distribution. The Gini coefficient is sensitive to inequality across the full long-tailed set of protocols, whereas HHI is dominated by the squared shares of the largest units and is conventionally interpreted as a market-concentration statistic. Therefore, the Gini result supports the claim of extreme inequality in protocol-level TVL, while the HHI should not be read as indicating high market concentration under conventional antitrust thresholds. For this reason, comparisons with traditional banking concentration should be treated as contextual rather than metric-equivalent, since banking concentration is usually reported through HHI, CR5, or similar market-share indicators rather than through a cross-institution Gini coefficient. This pattern is consistent with liquidity network effects, in which larger liquidity pools attract additional liquidity in proportion to their existing scale, plausibly reflecting the lower slippage and greater market depth such pools offer, characteristic of winner-takes-all dynamics in two-sided markets rather than of conventional competitive constraints.

Although these results provide a comprehensive snapshot of ecosystem-wide concentration, they do not indicate whether the proposed liquidity network mechanism operates uniformly across blockchain networks or whether it depends on network-specific characteristics such as maturity, transaction costs, and available liquidity. Figure 2 examines this question by analyzing the daily evolution of Uniswap activity concentration across four blockchain networks with distinct historical trajectories and transaction-cost structures (Ethereum L1, Arbitrum, Optimism, and Polygon) during the period from 2021 to 2022.

A Kruskal–Wallis test performed on the weekly median values confirmed statistically significant and large differences among the four blockchain networks across all decentralization metrics (Gini: H = 138.08, p < 0.001, ϵ 2 = 0.514; HHI: H = 138.62, p < 0.001, ϵ 2 = 0.516; Nakamoto: H = 127.48, p < 0.001, ϵ 2 = 0.473; source entropy/diversity index: H = 140.69, p < 0.001, ϵ 2 = 0.524).

Figure 2a shows that the temporal variability of the Gini coefficient differs markedly across networks. Ethereum L1 remains comparatively stable throughout the observation period, whereas Arbitrum fluctuates between approximately 0.50 and 0.95. This behavior is consistent with the microstructure of relatively thin markets: in a recently deployed network supported by a limited number of major liquidity providers, the entry or exit of a single large participant substantially alters the overall concentration. By contrast, the deeper and more diversified liquidity base of Ethereum L1 absorbs the same type of event with considerably smaller changes in aggregate concentration.

The Herfindahl–Hirschman Index presented in Figure 2b exhibits an extreme peak for Arbitrum (above 1,100 on the source dataset’s 0–10,000 scale) during the initial phase of the network, coinciding with the launch of Arbitrum One in August 2021. Such exceptionally high concentration during the first weeks of operation is consistent with an initial migration of liquidity driven by a relatively small group of early adopters before trading activity progressively diffused across a broader user base.

Figure 2c shows that Polygon reaches Nakamoto coefficients that are one to two orders of magnitude higher than those observed in the remaining networks, with peaks approaching 22,000 compared with values ranging from several hundred to only a few thousand elsewhere. Because the Nakamoto coefficient represents the minimum number of participants required to control the majority of transaction volume, this result is consistent with broader participation on Polygon, plausibly reflecting lower transaction costs that make participation economically feasible even for users trading relatively small amounts. In contrast, such participation is considerably less attractive on Ethereum L1 and, to a lesser extent, on other Layer-2 networks. This interpretation must remain scale-aware: Polygon’s larger active-address base contributes to the Nakamoto gap, since the coefficient scales mechanically with the number of active participants; the Gini coefficient in Figure 2a does not identify Polygon as a comparable outlier.

Accordingly, Figure 2d reports the adopted source entropy/diversity index as effective Shannon diversity on the source scale, rather than as normalized Shannon entropy in bits. The source entropy/diversity index reinforces the same pattern on the dataset’s own scale. Because this measure captures dispersion across the participant-volume distribution but also co-varies with the number of active participants, it should not be interpreted as a scale-free decentralization statistic. Polygon therefore exhibits higher count-based diversity than the remaining networks. Still, part of this difference reflects Polygon’s larger active-address base rather than a purely qualitative change in distributional shape.

Post-hoc pairwise Mann–Whitney tests with Bonferroni correction further support these findings. Polygon differs significantly from each of the other three networks in both the Nakamoto coefficient and source entropy/diversity index (p Bonferroni < 0.001 for all six pairwise comparisons involving Polygon). In contrast, Arbitrum and Optimism are not statistically distinguishable for either metric ( p Bonferroni = 1.0 ). At the same time, Optimism and Ethereum L1 also show no significant difference in the source entropy/diversity index ( p Bonferroni = 0.208 ).

4.2 Growth and diversification of ERC-20 trading activity

Although the previous section established that aggregate capital is highly concentrated among a small number of protocols, that static distribution does not reveal how the economic activity sustaining the ecosystem has evolved over time. In particular, it remains unclear whether the observed growth reflects the continuous incorporation of new participants or a progressive intensification of activity among an already established user base. Table 1 addresses this temporal dimension by summarizing five representative snapshots of ERC-20 trading activity between 2015 and 2024.

The multi-order-of-magnitude growth observed between 2015 and 2019 coincides with two well-documented milestones in the evolution of the Ethereum ecosystem: the Initial Coin Offering (ICO) boom of 2017 and the emergence of decentralized finance during the 2019–2020 “DeFi Summer.” This temporal correspondence supports the use of the sampled snapshots to characterize selected phases of ecosystem development, while providing no basis for treating them as a complete reconstruction of the historical trajectory.

From the perspective of economic systems, however, the most significant finding is the decoupling between participant growth and transaction activity after 2021. The number of unique issuing addresses decreased slightly from 2,738,732 in 2021 to 2,709,025 in 2024 (a contraction of 1.08 %), whereas the total number of transactions increased by 27.9 % during the same period. This divergence between the extensive margin (number of participants) and the intensive margin (transactions per participant) indicates that recent ERC-20 growth in the sampled observations is concentrated in transaction intensity rather than in the expansion of the issuing-address population. Automated agents, smart contracts, bots, and batch transaction execution constitute plausible mechanisms for this pattern, but the aggregated snapshot data do not identify their individual contributions. Consequently, the notion of “growth” in the ERC-20 ecosystem should be interpreted with caution, as higher transaction volumes do not necessarily imply a broader participant base.

Aggregate transaction counts alone, however, cannot distinguish whether ecosystem growth reflects an increase in the number of participants, greater activity among existing participants, or a combination of both. Figure 3 decomposes this evolution into four complementary indicators, transactions, issuing addresses, receiving addresses, and active tokens, to identify the specific dimension in which this divergence emerges.

Figure 3a shows a growth trajectory that, when represented on a logarithmic scale, resembles the early exponential phase of a classic S-shaped technology adoption curve. The reduced growth rate observed between 2021 and 2024, while still maintaining an increasing absolute transaction volume, may indicate that the ERC-20 standard, as a foundational building block of the Ethereum ecosystem, is approaching a mature stage of adoption. At the same time, new on-chain activity may increasingly be shifting toward token standards beyond the scope of this analysis, such as ERC-721 (NFTs) and ERC-4626 tokenized vaults. This scope limitation should therefore be considered when interpreting the apparent slowdown in ERC-20 growth.

Figure 3b illustrates the apparent stabilization between the sampled 2021 and 2024 observations and represents the central finding of this figure. Unlike the remaining indicators, which continue to increase throughout the observation period, the number of unique issuing addresses is essentially unchanged between the 2021 and 2024 snapshots, making the extensive margin the only sampled dimension that does not continue to expand. In contrast, Figure 3c shows that the number of unique receiving addresses nearly doubled between 2021 and 2024 while the number of issuing addresses remained essentially unchanged. This asymmetry between stable issuing activity and expanding receiving activity is consistent with the growing use of contract-mediated distribution mechanisms, including airdrops, one-to-many reward distributions, and decentralized exchange (DEX) routers acting as intermediate recipients. Together, these mechanisms reflect economic behaviors that differ substantially from those represented by the issuing-address dynamics.

Figure 3d documents a near-exponential increase in the number of active ERC-20 tokens, from 14,722 in 2019 to 47,647 in 2024. This expansion reflects the combination of the extremely low technical barrier to deploying new ERC-20 tokens, which requires only a single deployment transaction, and successive speculative cycles associated with meme tokens. This long-tail behavior in asset creation is conceptually analogous to the strong concentration of capital across protocols previously identified (Gini = 0.985 for aggregate TVL). In this case, however, the concentration phenomenon is expressed through the proliferation of distinct assets rather than through the distribution of the capital they collectively hold.

4.3 Detection and explanation of illicit behavior in bitcoin transaction networks

Although the previous sections characterized the structure and temporal evolution of blockchain activity at the ecosystem level, they do not establish whether individual transactions can be reliably classified as licit or illicit based solely on their transactional characteristics, nor the corresponding trade-off between false positives and false negatives. Table 3 addresses this question by reporting the performance of a Random Forest classifier trained on the Elliptic Bitcoin dataset and evaluated under the temporal partitioning protocol proposed by (Weber et al., 2019).

TABLE 3. Classification performance of the Random Forest model for illicit transaction detection on the Elliptic Bitcoin dataset (test set: time steps 35–49; n = 16,670).

The pronounced asymmetry between the very high precision achieved for the illicit class (0.988) and its more moderate recall (0.692) is more than a numerical observation; it defines the operational profile that this classifier would exhibit in a real-world deployment. Such a system would rarely classify legitimate transactions as suspicious, thereby minimizing operational friction for legitimate users. However, it would also fail to detect approximately 31% of illicit transactions. Consequently, this model is better suited as a prioritization tool for human review (i.e., transaction flagging) than as a fully automated transaction-blocking mechanism. This distinction has direct practical implications for the design of compliance and anti-money laundering (AML) systems operating on public blockchain infrastructures.

The comparison with the original benchmark by (Weber et al., 2019) was verified against Table 2 of that paper. In that table, AF denotes the 166 original Elliptic features, LF denotes the 94 local features, and NE denotes node embeddings computed by GCN. The directly comparable non-embedding RandomForest AF row reports illicit-class precision = 0.956, recall = 0.670, and F1-score = 0.788, whereas the enhanced RandomForest AF + NE row reports precision = 0.971, recall = 0.675, and F1-score = 0.796. The present model therefore shows a similar high-precision/moderate-recall profile, while the exact numerical values differ from the original benchmark. Figure 4 further investigates this behavior by analyzing the contribution of each feature group using SHAP values.

The central finding in Figure 4 is that local transaction features account for 74.4% of the aggregate SHAP importance, compared with 25.6% for neighborhood features, exceeding the 56.4%/43.6% split implied by the 93-to-72 feature-count ratio between the two groups. On a per-feature basis, mean absolute SHAP equals 0.00474 for local features and 0.00211 for neighborhood features, implying an approximately 2.25-fold local-feature advantage relative to the size-neutral baseline. The single most influential individual feature is a local transaction feature (mean | S H A P | = 0.0304), and four of the five top-ranked individual features are local; the highest-ranked neighborhood feature ranks fifth overall (mean | S H A P | = 0.0150, about half the top local feature’s value). This result has implications beyond the general observation that local features receive more attribution. Specifically, it indicates that, in this dataset, SHAP attribution is more concentrated in the local-feature group than in the neighborhood-feature group. Because neighborhood (aggregated) features are constructed from statistics of the one-hop local features of neighboring transactions, the two feature groups are correlated by construction, and Shapley-value attribution under correlated features can distribute credit for a shared signal unevenly between them.

This attribution pattern motivates further evaluation of how transaction-level and neighborhood-level representations contribute to AML detection. Because the two feature groups are correlated by construction, the present SHAP analysis does not establish that transaction-level variables contain intrinsically greater predictive information. Likewise, hypotheses involving deliberate neighborhood-evasion strategies by illicit actors require behavioral or adversarial evidence beyond the scope of the Elliptic attribution analysis.

4.4 Mechanism design: loan ratios and incentive alignment in bitcoin

Although the previous section demonstrated that illicit behavior can be identified at the transaction level, it does not explain how aggregate lending-market architecture and reported balance-sheet quantities differ across protocols competing for similar liquidity. Table 4 addresses this question by comparing the borrowed-to-deposited ratio and the corresponding deposited-TVL volatility in Aave V3 and Compound V3.

TABLE 4. Borrowed-to-deposited ratio and deposited-TVL volatility for Aave V3 and Compound V3 (99 protocol-month observations, excluding two startup months with average deposited TVL below USD 50 million).

The results show that Aave V3 exhibits a higher and substantially more dispersed borrowed-to-deposited ratio than Compound V3 over the analyzed period (mean monthly ratio 0.410, bootstrap 95% CI [0.392, 0.430], versus 0.300, 95% CI [0.293, 0.306], respectively; 10,000 resamples). This difference must be interpreted alongside the protocols’ distinct architectures and reporting structures rather than as the isolated effect of any single parameter. Aave V3’s multi-asset pooled architecture, in which most listed assets can be simultaneously supplied and borrowed, contrasts with Compound V3’s single-base-asset design, in which only one asset per deployment is borrowable; this architectural difference changes the economic meaning of the denominator in Equation 7. Possible differences in loan-to-value limits, utilization thresholds, or interest-rate curve configurations may also contribute, but the present analysis does not isolate those mechanisms separately.

A Mann–Whitney U test confirms that the difference between the two protocols is statistically significant (U = 2436, p < 0.001), with a very large absolute effect size (| r rb | = 0.993), indicating an almost complete separation between the monthly distributions of the borrowed-to-deposited ratio. Likewise, the considerably narrower distribution observed for Compound V3 is consistent with its Comet architecture and reporting basis, although the available aggregate series do not distinguish the independent effects of collateral design, borrowing incentives, loan-to-value limits, or interest-rate curves.

Aggregate differences, however, do not reveal whether these behavioral patterns remain stable over time or how each protocol responds to changing market conditions. Mechanism design extends beyond the static parameterization of a lending protocol; it also determines whether participant incentives remain aligned with network stability and long-term security. Figure 5 addresses both dimensions by presenting the temporal evolution of the borrowed-to-deposited ratio and deposited-TVL volatility for Aave V3 and Compound V3, together with the historical composition of Bitcoin miners’ incentives throughout the network’s operational history.

Figure 5a shows that, apart from a small number of early observations, deposited-TVL volatility remains consistently low across the full range of borrowed-to-deposited ratios. A Spearman correlation analysis indicates that the within-protocol associations differ descriptively in sign and magnitude; a formal test comparing the two correlation coefficients was not conducted. In Aave V3, the correlation is positive, weak, and statistically significant (ρ = 0.321, 95% CI [0.053, 0.546] via Fisher z-transformation, p = 0.020, n = 52), whereas in Compound V3 it is negative, of moderate magnitude, and statistically significant (ρ = − 0.433, 95% CI (− 0.640, − 0.166), p = 0.002, n = 47).

These results qualify the visual interpretation of the scatter plot. In Aave V3, higher utilization is associated with slightly greater deposited-TVL volatility, whereas in Compound V3, periods with the highest utilization tend to coincide with lower volatility. Because deposited TVL is denominated in USD, both correlations partly absorb collateral-price movements as well as genuine deposit and withdrawal flows. The observed relationship should therefore be read as descriptively different within-protocol balance-sheet co-movement in the available DeFiLlama series rather than as a clean mechanism-design effect. This interpretation should be validated using datasets that include native-asset deposit quantities and periods of substantially greater market stress.

As an illustrative example that the robustness of utilization mechanisms does not encompass all dimensions of protocol risk, the DeFiLlama incident log ¹ records a security event affecting Aave V3 (CAPO oracle configuration error, 12 March 2026; approximately USD 862,000 exposed and subsequently fully recovered). Even a protocol with relatively stable utilization dynamics, as observed in this analysis, remains vulnerable to a different class of mechanism risk: the integrity of its price-oracle infrastructure. This example illustrates that the robustness of DeFi lending mechanisms depends on at least two largely independent dimensions: the design of economic parameters (utilization thresholds and interest-rate curves) and the integrity of the underlying data infrastructure (price oracles), which are typically analyzed and secured independently.

Figure 5b shows that block subsidies dominate Bitcoin miner revenue throughout almost the entire 6,409-day observation period. This reflects the structural properties of Bitcoin’s issuance schedule, characterized by geometric reductions through successive halving events, rather than the emergence of a mature transaction-fee market. Consequently, the long-standing concern regarding Bitcoin’s security budget remains relevant. As block subsidies continue to decline toward zero over the coming decades, transaction fees will necessarily become an increasingly important component of miner revenue. The historically low and highly variable fee levels observed here suggest that this transition is still incomplete.

Figure 5c reinforces this interpretation. The intermittent increases in the proportion of transaction fees are consistent with episodic demand conditions rather than with a sustained increase in the fee share of miner revenue. Potential explanations include bull-market activity and periods of intensified inscription or Ordinals usage, although the present analysis does not isolate the contribution of these events. Consequently, the stable revenue base required to support Bitcoin’s long-term security budget has not yet been established.

Figure 5d reveals a close correspondence between mining difficulty and the estimated network hash rate throughout the observation period. Because Bitcoin’s protocol mechanically retargets difficulty toward the observed hash rate approximately every 2 weeks, this correspondence is largely definitional. It functions here as a validity check confirming that the two Open Bitcoin Metrics series were correctly extracted and aligned, rather than as an independent empirical confirmation of the difficulty-adjustment mechanism itself. The plateau and partial correction observed during 2025–2026 following several years of sustained growth may reflect miners responding to changing revenue conditions, hardware efficiency, energy costs, or broader market expectations; the present analysis does not isolate these candidate explanations. Together, the three Bitcoin panels offer a mechanism-design perspective on the still-incomplete transition of the network’s long-term security budget.

5 Discussion

Protocol-level TVL is highly unequal, although the Gini coefficient and HHI characterize different distributional properties and do not support an identical concentration interpretation. The Gini coefficient of 0.985 computed from aggregated TVL indicates extreme inequality across the full protocol distribution, whereas the HHI remains below conventional thresholds for high market concentration. The temporal Uniswap indicators add a separate network-level view of decentralization dynamics rather than a metric-equivalent confirmation of TVL concentration. At the same time, the divergence between the Gini coefficient and the Nakamoto and entropy/diversity measures observed for Polygon must be interpreted as scale-sensitive evidence. Because the Nakamoto coefficient and the effective-diversity series increase mechanically with the number of active addresses, Polygon’s larger active-address base can amplify those measures even when the Gini coefficient does not identify Polygon as an equivalent outlier. This observation highlights the need for conceptual precision when comparing decentralization metrics across blockchain ecosystems, since different indicators combine distributional shape and participant-count effects in different ways.

The evolution of ERC-20 activity further complements this interpretation. The apparent stabilization of the extensive margin in the sampled observations, together with the sustained expansion of the intensive margin, is consistent with a form of market maturation in which activity intensity grows faster than the number of issuing participants. Consequently, concentration may continue to be observed even when the sampled participant population remains relatively stable.

Within the intelligent-agents pillar, the classifier achieves the reported aggregate performance on the temporally held-out test steps. Because performance was not evaluated separately across multiple temporal windows, the analysis does not establish temporal stability. A recall of approximately 69% for illicit transactions combined with an overall accuracy of approximately 97.9% characterizes a deliberately conservative classifier whose residual error is concentrated primarily in false negatives rather than false positives. Furthermore, the finding that local transaction features account for nearly three-quarters of the aggregate SHAP importance, exceeding the 56.4% share expected under a size-proportional null baseline, whereas neighborhood features contribute approximately one-quarter, has practical implications for compliance systems, though the correlation between local and neighborhood features by construction means this contrast reflects the model’s use of the two feature groups rather than their independent informativeness. At least for the analyzed time period, transaction-level features receive greater model attribution than graph-neighborhood features on a per-feature basis in the analyzed Random Forest, without implying independent predictive superiority of either feature group.

From a mechanism-design perspective, the observed utilization differences coexist with descriptively different within-protocol deposited-TVL volatility associations, but the present analysis does not isolate the independent effects of architecture, collateral design, interest-rate parameters, or USD price movements. This finding qualifies the common assumption that higher utilization inevitably results in greater systemic fragility, although it does not exclude this possibility under more severe market conditions than those represented in the present dataset. The oracle configuration incident affecting Aave V3 further illustrates that robustness in economic mechanism design does not necessarily imply robustness of the supporting data infrastructure. These observations suggest that economic parameters and oracle integrity represent largely independent dimensions of protocol risk that require separate auditing methodologies.

For Bitcoin, the continued dominance of block subsidies in miner revenue indicates that the transition toward a mature transaction-fee market remains incomplete. Consequently, the long-term sustainability of the network’s security budget continues to depend predominantly on the issuance mechanism rather than on endogenous fee generation. Unlike the lending protocols analyzed in this study, this issue operates over substantially longer temporal horizons and therefore represents a distinct mechanism-design challenge.

Existing blockchain auditing and observability tools take a different approach. Widely used industry platforms, including blockchain explorers, on-chain analytics dashboards such as Nansen and DeFiLlama itself, and compliance-oriented tools such as Chainalysis, provide real-time visibility into individual transactions, wallet activity, or protocol-level TVL, but typically report each data source and metric independently, without a shared verification protocol linking them. Academic frameworks for blockchain data quality have likewise tended to focus on a single layer at a time, for instance, decentralization metrics for a single network (Chemaya et al., 2025) or TVL as an aggregate indicator (Luo et al., 2026), echoing Soleimanof and Neufeld (2026)’s broader argument that claims of decentralization should be empirically verified rather than assumed. The protocol instead applies a documented, stratified-sampling-based verification procedure to the four primary sources processed directly in the study, while treating the Uniswap decentralization indices as an adopted derived source that is explicitly harmonized but not recomputed from raw transactions. This scope distinction allows the framework to function as an audit layer upstream of existing observability tools without overstating the uniformity of the preprocessing applied to all sources.

Several of these findings also permit direct comparison with recent studies. The higher per-feature SHAP attribution assigned to local transaction features offers a useful contrast with recent graph-based contrastive learning approaches proposed by Ouyang et al. (2024) and Lu and Wang (2024), where improved predictive performance is generally attributed to neighborhood representations. The present results do not rule out the value of neighborhood information; rather, they suggest that graph-learning architectures may capture higher-order interactions among neighboring local features that additive SHAP explanations derived from Random Forest models cannot explicitly represent.

Similarly, the co-clustering framework proposed by Pensa et al. (2025) offers a complementary strategy for investigating this hypothesis without requiring semantic feature descriptions, which are unavailable in the Elliptic dataset. Within the mechanism-design literature, the greater utilization and wider utilization distribution observed in Aave V3 relative to the more conservative behavior of Compound V3 are consistent with the stability–efficiency trade-offs formalized by d’Avernas et al. (2026) in the context of stablecoin design. Finally, the aggregate behavioral differences observed between the analyzed lending protocols coexist with differences in protocol architecture and design, whereas the present analysis provides no direct evidence of autonomous-agent coordination. These observations provide empirical context for the proposition advanced by Touloupou and Kapassa (2026) regarding AI agents as autonomous economic actors in on-chain governance, but they do not isolate the causal determinants of aggregate lending-market behavior.

These findings should be interpreted in light of several study limitations. First, all empirical analyses are observational and retrospective; therefore, the reported associations, group differences, and feature attributions should not be interpreted as causal effects. Second, the ERC-20 activity analysis is based on five monthly snapshots spanning 2015 to 2024 rather than a continuous historical census, and therefore characterizes long-term trends rather than exact cumulative activity. Third, the Aave V3 oracle incident represents a single illustrative case and cannot support statistical inference regarding the frequency or expected economic impact of oracle failures. Fourth, because the Elliptic dataset does not publicly disclose the semantic meaning of its individual features, SHAP attribution is limited to comparisons between local and neighborhood feature groups and does not permit causal interpretation of specific transaction characteristics. In addition, the licit/illicit labels in the Elliptic dataset originate from external forensic heuristics and investigative attribution rather than from independently observable ground truth, so classifier performance should be interpreted as agreement with that labeling framework. Fifth, the Uniswap, ERC-20, and DeFiLlama analyses are concentrated on the Ethereum Virtual Machine ecosystem, the mechanism-design comparison covers only two lending protocols, and all analyses are retrospective; the findings therefore characterize Ethereum-based DeFi, Bitcoin, and the two protocols examined rather than blockchain-based finance as a whole.

In addition, the relationship observed between utilization and deposited-TVL volatility corresponds to a period without extreme market events comparable to large-scale cascading liquidations and therefore should not be generalized to episodes of severe systemic stress. Because deposited TVL is denominated in USD while the underlying deposits are predominantly volatile crypto-assets, its month-to-month volatility partly reflects price movements rather than only deposit and withdrawal flows. Finally, the aggregated TVL used to characterize ecosystem concentration combines assets associated with substantially different risk profiles, including centralized custody platforms and non-custodial DeFi protocols. Consequently, the reported concentration metrics should be interpreted as describing the overall ecosystem rather than a homogeneous economic environment.

6 Conclusion

This study identifies pronounced inequality in protocol-level TVL, heterogeneous network-level decentralization dynamics, greater per-feature attribution assigned to transaction-level variables than to graph-neighborhood variables in the analyzed Random Forest, and aggregate lending-protocol differences that coexist with differences in protocol architecture and design while providing no direct evidence of autonomous-agent coordination. Taken together, these findings suggest that, despite the technological innovations introduced by blockchain, DeFi, and artificial intelligence, the resulting ecosystem continues to reproduce several structural risk patterns also observed in traditional financial systems.

This work’s principal contribution is not a single empirical finding but a reproducible audit and analytical framework that integrates five publicly available data sources while preserving source-specific provenance. Four sources are processed through direct audit, canonicalization, and metric computation, while the Uniswap decentralization indices are incorporated as a published derived dataset with an explicitly documented measurement scale. Rather than treating concentration, intelligent agents, and mechanism design as separate research topics, the proposed framework evaluates them through a unified empirical lens. This integration has practical implications for multiple stakeholders. For regulators, the finding that centralized-exchange custody alone accounts for half of aggregate TVL indicates that headline concentration statistics should be decomposed by category before calibrating systemic-risk thresholds or capital requirements, since a single aggregated Gini or TVL figure conflates custodial and non-custodial risk into one number. For compliance practitioners designing blockchain analytics and transaction-monitoring systems, the SHAP results indicate that transaction-level features receive more than a size-proportional share of model attribution in the analyzed Random Forest, without establishing independent predictive superiority over graph-neighborhood features. For protocol designers at lending platforms, the observed Aave V3–Compound V3 contrast suggests that aggregate utilization and deposited-TVL volatility should be interpreted together with protocol architecture, collateral design, and USD price exposure rather than as a direct readout of any single utilization-limit or interest-rate-curve parameter.

The identified limitations naturally define several directions for future research. The ERC-20 activity analysis should be extended from five sampled temporal periods to continuous monthly observations in order to determine whether the apparent stabilization of the extensive margin between 2021 and 2024 reflects a structural market trend or a sampling artifact. The illustrative Aave V3 oracle incident should be expanded into a systematic corpus of lending-protocol security events to enable statistical inference regarding the frequency and economic impact of oracle failures. Likewise, the absence of semantic descriptions for the Elliptic dataset features motivates the application of graph-learning approaches capable of evaluating higher-order interactions without requiring explicit feature semantics, thereby providing a direct test of whether the reported advantages of graph-based methods originate from neighborhood structure itself or from complex interactions among local features across multiple nodes. Finally, the relationship between borrowed-to-deposited ratio and deposited-TVL volatility should be evaluated under periods of severe market stress, where the descriptively different within-protocol associations observed in this study may differ substantially from those observed under relatively stable market conditions. Extending the audit protocol itself to additional blockchain ecosystems beyond the Ethereum-EVM and Bitcoin scope analyzed here would further test the generality of the cross-pillar approach proposed in this study.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. The authors verify and take full responsibility for the content of this manuscript. Grammarly Pro was used solely to assist with grammar, spelling, punctuation, and language clarity during manuscript preparation. The authors reviewed, verified, and accepted or rejected the AI-assisted suggestions. No AI-generated scientific content, data analysis, results, interpretations, or conclusions were produced using generative AI.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Yulin Liu, Swiss Quantum Economics AI Lab, Switzerland

Reviewed by: Fangzhou Tang, Peking University, China

Olubukola Omolara Adebiyi, University of the Cumberlands, United States

Md Farhad Kabir, New Jersey Institute of Technology, United States

Footnotes

https://defillama.com/hacks, accessed 2026-07-24.