Abstract
<title>Abstract</title> <p>Cryptocurrency rug pulls, in which token developers withdraw liquidity or otherwise abandon a project after attracting investment, remain a persistent and costly form of decentralized finance (DeFi) fraud. Prior detection approaches, whether feature-engineered supervised classifiers or temporal graph learning models, are typically trained and periodically retrained on labeled data, without an explicit, continuously operating mechanism to detect when the underlying decision boundary has drifted between retraining cycles. Malware threat intelligence has separately developed and validated concept-drift-aware incremental clustering specifically to address this class of problem for evolving malware families. This paper adapts that methodology to the cryptocurrency rug-pull domain and evaluates it empirically against a periodically retrained supervised baseline on a real, temporally-hygienic dataset of 633 labeled Ethereum token projects. Using a strict chronological warm-start, validation, and held-out test split explicitly designed to avoid the hyperparameter-tuning leakage identified and corrected during this study we find that the periodic-retrain baseline achieves marginally higher F1-score (mean 0.891, std 0.008) than the drift-aware clustering approach (mean 0.873, std 0.014) across five independent chronological splits, and is substantially more stable, exhibiting far lower variance in precision across time periods (std 0.015 versus 0.064 for clustering). The clustering approach's principal advantage is a markedly lower false-positive rate in several splits, at the cost of reduced and less stable recall. These findings offer a specific, mechanistically grounded, and negative-leaning result for the transfer of drift-aware clustering from malware detection to on-chain fraud detection under this feature set, and motivate concrete directions richer behavioral features, principled hyperparameter search, and comparison against temporal graph learning baselines for future work.</p>