In recent years, there have been incidents which decreased people's trust in some organizations and authorities responsible for ratings and accreditation. For a few prominent examples, there was a security breach at Equifax (2017), misconduct was found in the Standard & Poor's Ratings Services (2015), and the Accrediting Council for Independent Colleges and Schools (2022) validated some of the low-performing schools as delivering higher standards than they actually were. A natural solution to these types of issues is to decentralize the relevant trust management processes using blockchain technologies. The research problems which are tackled in this thesis consider the issue of trust in reputation for assessment and review credibility at different angles, in the context of blockchain applications. We first explored the following questions. How can we trust courses in one college to provide students with the type and level of knowledge which is needed in a specific workplace? Micro-accreditation on a blockchain was our solution, including using a peer-review system to determine the rigor of a course (through a consensus). Rigor is the level of difficulty in regard to a student's expected level of knowledge. Currently, we make assumptions about the quality and rigor of what is learned, but this is prone to human bias and misunderstandings. We present a decentralized approach that tracks student records throughout the academic progress at a school and helps to match employers' requirements to students' knowledge. We do this by applying micro-accredited topics and Knowledge Units (KU) defined by NSA's Center of Academic Excellence to courses and assignments. We demonstrate that the system was successful in increasing accuracy of hires through simulated datasets, and that it is efficient, as well as scalable. Another problem is how can we trust that the peer reviews are honest and reflect an accurate rigor score? Assigning reputation to peers is a natural method to ensure correctness of these assessments. The reputation of the peers providing rigor scores needs to be taken into account for an overall rigor of a course, its topics, and its tasks. Specifically, those with a higher reputation should have more influence on the total score. Hence, we focused on how a peer's reputation is managed. We explored decentralized reputation management for the peers, choosing a decentralized marketplace as a sample application. We presented an approach to ensuring review credibility, which is a particular aspect of trust in reviews and reputation of the parties who provide them. We use a Proof-of-Stake based Algorand system as a base of our implementation, since this system is open-source, and it has a rich community support. Specifically, we directly map reputation to stake, which allows us to deploy Algorand at the blockchain layer. Reviews are analyzed by the proposed evaluation component using Natural Language Processing (NLP). In our system, NLP gauges the positivity of the written review, compares that value to a scaled numerical rating given, and determines adjustments to a peer's reputation from that result. We demonstrate that this architecture ensures credible and trustworthy assessments. It also efficiently manages the reputation of the peers, while keeping reasonable consensus times. We then turned our focus on ensuring that a peer's reputation is credible. This led us to introducing a new type of consensus called "Proof-of-Review". Our proposed implementation is again based on Algorand, since its modular architecture allows for easy modifications, such as adding extra components, but this time, we modified the engine. The proposed model then provides a trust in evaluations (review and assessment credibility) and in those who provide them (reputation credibility) using a blockchain. We introduce a blacklisting component, which prevents malicious nodes from participating in the protocol, and a minimum-reputation component, which limits the influence of under-performing users. Our results showed that the proposed blockchain system maintains liveliness and completeness. Specifically, blacklisting and the minimum-reputation requirement (when properly tuned) do not affect these properties. We note that the Proof-of-Review concept can be deployed in other types of applications with similar needs of trust in assessments and the players providing them, such as sensor arrays, autonomous car groups (caravans), marketplaces, and more.
With the proliferation of blockchain technology in decentralized applications like decentralized finance and supply chain and identity management, smart contracts operating on a blockchain frequently encounter security issues such as reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and integer overflow vulnerabilities. These security concerns pose a significant risk of causing substantial losses to user accounts. Consequently, the detection of vulnerabilities in smart contracts has become a prominent area of research. Existing research exhibits limitations, including low detection accuracy in traditional smart contract vulnerability detection approaches and the tendency of deep learning-based solutions to focus on a single type of vulnerability. To address these constraints, this paper introduces a smart contract vulnerability detection method founded on multimodal feature fusion. This method adopts a multimodal perspective to extract three modal features from the lifecycle of smart contracts, leveraging both static and dynamic features comprehensively. Through deep learning models like Graph Convolutional Networks (GCNs) and bidirectional Long Short-Term Memory networks (bi-LSTMs), effective detection of vulnerabilities in smart contracts is achieved. Experimental results demonstrate that the proposed method attains detection accuracies of 85.73% for reentrancy vulnerabilities, 85.41% for timestamp dependency vulnerabilities, 83.58% for tx.origin vulnerabilities, and 90.96% for integer Overflow vulnerabilities. Furthermore, ablation experiments confirm the efficacy of the newly introduced modal features, highlighting the significance of fusing dynamic and static features in enhancing detection accuracy.
Web3, the next generation of the Internet, represents a decentralized and democratized web. Although it has garnered significant public interest and found numerous real-world applications, there is a limited understanding of people's perceptions and experiences with Web3. In this study, we conducted an empirical study to investigate the categories of Web3 applications and their popularity, as well as the potential challenges and opportunities within this emerging landscape. Our research was carried out in two phases. In the first phase, we analyzed 200 popular Web3 projects associated with 10 leading Web3 venture capital firms. In the second phase, we collected and examined code-related data from GitHub and market-related data from blockchain browsers (e.g., Etherscan) for these projects. Our analysis revealed that the Web3 ecosystem can be categorized into two groups, i.e., Web3 infrastructure and Web3 applications, with each consisting of several subcategories or subdomains. We also gained insights into the popularity of these Web3 projects at both the code and market levels and pointed out the challenges in the Web3 ecosystem at the system, developer, and user levels, as well as the opportunities it presents. Our findings contribute to a better understanding of Web3 for researchers and developers, which in turn promotes further exploration and advancement in this innovative field.
Ayodeji Adeniran, Mohammed Alkinoon, Aziz Mohaisen
We present our results on analyzing and understanding the behavior and security of various metaverse platforms incorporating cryptocurrencies. We obtained the top metaverse coins with a capitalization of at least 25 million US dollars and the top metaverse domains for the coins, and augmented our data with name registration information (via whois), including the hosting DNS IP addresses, registrant location, registrar URL, DNS service provider, expiry date and check each metaverse website for information on fiat currency for cryptocurrency. The result from virustotal.com includes the communication files, passive DNS, referrer files, and malicious detections for each metaverse domain. Among other insights, we discovered various incidents of malicious detection associated with metaverse websites. Our analysis highlights indicators of (in)security, in the correlation sense, with the files and other attributes that are potentially responsible for the malicious activities.
Yuheng Zhang, Liu Pin, Guojun Wang, Peiqiang Li · 8 authors
With the evolution of blockchain technology, the issue of transaction security, particularly on platforms like Ethereum, has become increasingly critical. Front-running attacks, a unique form of security threat, pose significant challenges to the integrity of blockchain transactions. In these attack scenarios, malicious actors monitor other users' transaction activities, then strategically submit their own transactions with higher fees. This ensures their transactions are executed before the monitored transactions are included in the block. The primary objective of this paper is to delve into a comprehensive classification of transactions associated with front-running attacks, which aims to equip developers with specific strategies to counter each type of attack. To achieve this, we introduce a novel detection method named FRAD (Front-Running Attacks Detection on Ethereum using Ternary Classification Model). This method is specifically tailored for transactions within decentralized applications (DApps) on Ethereum, enabling accurate classification of front-running attacks involving transaction displacement, insertion, and suppression. Our experimental validation reveals that the Multilayer Perceptron (MLP) classifier offers the best performance in detecting front-running attacks, achieving an impressive accuracy rate of 84.59% and F1-score of 84.60%.
Sepideh HajiHosseinKhani, Arash Habibi Lashkari, Ali Mizani Oskui
Smart Contracts (SCs) are crucial in maintaining trust within blockchain networks. However, existing methods for analyzing SC vulnerabilities often lack accuracy and effectiveness, while approaches based on Deep Neural Networks (DNN) struggle with detecting complex vulnerabilities due to limited data availability. This paper proposes a novel approach to analyze Smart Contracts (SCs) vulnerabilities. Our method leverages an advanced form of Genetic Algorithm (GA) and includes the development of a comprehensive benchmark dataset consisting of 36,670 Solidity source code samples. The primary objective of our study is to profile vulnerable SCs effectively. To achieve this goal, we have devised an analyzer called SCsVulLyzer based on Genetic Algorithms, designed explicitly for profiling SCs. Additionally, we have carefully curated a new dataset encompassing a wide range of examples, ensuring the practical validation of our approach. Furthermore, we have established three distinct taxonomies that cover SCs, profiling techniques, and feature extraction. These taxonomies provide a systematic classification and analysis of information, improving the efficiency of our approach. Our methodology underwent rigorous testing through experimentation, and the results demonstrated the superior capabilities of our model in detecting vulnerabilities. Compared to traditional and DNN-based approaches, our approach achieved higher precision, recall, and F1-score, widely used metrics for evaluating model performance. Across all these metrics, our model showcased exceptional results. The customization and adaptations we implemented within the Genetic Algorithm significantly enhanced its effectiveness. Our approach detects smart contract vulnerabilities more efficiently and facilitates robust exploration. These promising results highlight the potential of GA-based profiling to improve the detection of smart contract vulnerabilities, contributing to enhanced security in blockchain networks.
The prosperity of Ethereum attracts many users to send transactions and trade crypto assets. However, this has also given rise to a new form of transaction-based phishing scam, named TxPhish. Specifically, tempted by high profits, users are tricked into visiting fake websites and signing transactions that enable scammers to steal their crypto assets. The past year has witnessed 11 large-scale TxPhish incidents causing a total loss of more than 70 million.
Online social networks (OSNs) are becoming more and more integrated into people's everyday lives. In any case, since all notable OSNs are controlled, there are a few issues with privacy, management, and security. Users are usually restricted to using the services that OSN firms deploy after agreeing the OSN agreements. But a lot of contracts let OSN companies get to user data to provide personalized services like ads. Users typically have to submit a number of elaborate applications or even stop using such Online Social Network (OSN) if they don't let the businesses use their information while protecting their privacy. Blockchain technology combined with a decentralized architecture can address the aforementioned problems. In this architecture, most of the network functions are distributed among the multiple nodes. It means they are responsible for managing their own network policies, security and performance because the network traffic directly flows between those nodes. It is suggested in this project work to create an OSN service based on blockchain technology and demonstrate its decentralized operation. An enormous amount of data with generally low security requirements can be decentralized by storing it in the Interplanetary File system (IPFS). This distributes data to nodes consisting of hundreds of thousands of individual computers connected to the IPFS, rather than storing data in a single centralized server. A decentralized autonomous organization that allows users to democratically self-manage the OSN may be established in order to promote user autonomy.
Abstract The vulnerability in smart contracts (SCs) on the blockchain system may lead to severe security compromises. The SC can be invoked from an externally owned account (EOA) or a contract account (CA). The account a user creates to receive or send ether is an EOA. A CA contains codes that can interact with SCs. In Solidity SC, some vulnerabilities can only be exploited by the interactions between CAs and vulnerable SCs, which can be named external‐risky vulnerabilities . Most state‐of‐the‐art (SOTA) detectors detect external‐risky vulnerabilities by executing contract codes as an EOA user, thus reporting many unexploitable vulnerabilities. Therefore, we propose a CA‐triggering method to identify exploitable external‐risky vulnerabilities in Solidity SCs. We first designed agent contracts to simulate CAs' interactions with the target SCs in the real blockchain environment. We then detect vulnerability exploitation by analyzing transaction logs between agent contracts and target SCs and identifying successful exploits. We implemented the CA‐triggering method in a tool named SoliTester and evaluated it using three benchmark datasets, which contain three types of external‐risky vulnerabilities, namely, Reentancy (RE), Unchecked Call (UcC), and TxOrigin (TO). The results show that SoliTester can efficiently detect exploitable external‐risky vulnerabilities with significantly better precisions and recalls than SOTA detectors.
Md Jahangir Alam, Ismail Hossain, Sai Puppala, Sajedul Talukder
Identity attacks, such as impersonation, identity theft, and fraudulent account creation, pose significant threats to the security and trustworthiness of Online Social Networks (OSNs). In this paper, we propose a robust and secure framework to verify user identities without compromising their privacy by developing a multi-layered framework leveraging zero-knowledge proof (ZKP) and Hyperledger Fabric private blockchain. We introduce a blockchain-based government identity provider system, coupled with a zero-knowledge proof-based signup process for social networks. Our prototype authenticates user identities in multiple layers, effectively mitigating fraudulent, cloned, and multiple account creations. Our experiments with n (n = 50) users showed a 100% success rate for our system, highlighting its effectiveness compared to other OSNs.
Trust is a critical element when it comes to news articles, and an important problem is how to ensure trust in the published information on news websites. First, this paper describes the inner workings of a proposed news-retrieval and aggregation architecture employed by a blockchain-based solution for fighting disinformation; this includes a comparison between existing information retrieval solutions. The decentralized nature of the solution is achieved by separating the crawling (i.e., extracting the web page links) from the scraping (i.e., extracting the article information) and having third-party actors extract the data. A majority-rule mechanism is used to determine the correctness of the information, and the blockchain network is used for traceability. Second, the steps needed to deploy the distributed components in a cloud environment seamlessly are discussed in detail, with a special focus on the open-source OpenStack cloud solution. Lastly, novel methods for achieving a truly decentralized architecture based on community input and blockchain technology are presented, thus ensuring maximum trust and transparency in the system. The results obtained by testing the proposed news-retrieval system are presented, and the optimizations that can be made are discussed based on the crawling and scraping test results.
Web3 systems expose a fundamentally different security landscape from centralized platforms, characterized by composability, pseudonymous identities, decentralized governance, and rapidly evolving attack strategies that span social, application, and protocol layers. Existing security mechanisms, such as static smart contract analysis, blacklist-based phishing detection, and network-level mitigation, operate in isolation and assume fixed threat models, limiting their effectiveness against adaptive, cross-layer adversaries. This position paper argues that securing Web3 requires a shift from static, tool-centric defenses to learning-driven security primitives capable of continuous reasoning, adaptation, and actuation. We introduce AI-powered smart certificates as a new security abstraction: programmable, continuously updated trust artifacts that integrate on-chain verifiability with off-chain machine learning signals derived from user behavior, transaction dynamics, and social context. Unlike traditional certificates or audits, these certificates maintain state, learn under distribution shift, and support automated policy enforcement and revocation in response to evolving threats. We argue that existing paradigms, formal verification, threat modeling, and isolated anomaly detection, are structurally limited in capturing the non-stationary and socio-technical nature of Web3 attacks. We outline an architecture in which AI-powered smart certificates serve as cross-layer sentinels that coordinate heterogeneous security signals in real time, and position smart certificates as a research direction, raising questions around learning under partial observability, adversarial adaptation, and trustworthy ML deployment in decentralized systems.
As an emerging technology, blockchain provides a range of advantages, such as decentralized and transparent data storage, secure access control, and enhanced data traceability. However, it is rarely applied in the field of public safety. This paper presents an in-depth survey of blockchain technology, focusing on its potential applications and implications within the field of public safety research. We explore the practical needs of multi-party data collaboration in emergency management and discusses the applicability and value of blockchain technology in this context. Additionally, this paper introduces and compares several popular blockchain platforms. By providing a comprehensive examination of blockchain technology and its potential benefits for public safety, this paper seeks to enhance understanding of the technology's capabilities, encourage further research, and inspire innovation in this domain.
Raghu Raman, Vinith Kumar Nair, Prema Nedungadi, Indrakshi Ray · 5 authors
The Darkweb, part of the deep web, can be accessed only through specialized computer software and used for illegal activities such as cybercrime, drug trafficking, and exploitation. Technological advancements like Tor, bitcoin, and cryptocurrencies allow criminals to carry out these activities anonymously, leading to increased use of the Darkweb. At the same time, computers have become an integral part of our daily lives, shaping our behavior, and influencing how we interact with each other and the world. This work carries out the bibliometric study on the research conducted on Darkweb over the last decade. The findings illustrate that most research on Darkweb can be clustered into four areas based on keyword co-occurrence analysis: (i) network security, malware, and cyber-attacks, (ii) cybercrime, data privacy, and cryptography, (iii) machine learning, social media, and artificial intelligence, and (iv) drug trafficking, cryptomarket. National Science Foundation from the United States is the top funder. Darkweb activities interfere with the Sustainable Development Goals (SDG) laid forth by the United Nations to promote peace and sustainability for current and future generations. SDG 16 (Peace, Justice, and Strong Institutions) has the highest number of publications and citations but has an inverse relationship with Darkweb, as the latter undermines the former. This study highlights the need for further research in bitcoin, blockchain, IoT, NLP, cryptocurrencies, phishing and cybercrime, botnets and malware, digital forensics, and electronic crime countermeasures about the Darkweb. The study further elucidates the multi-dimensional nature of the Darkweb, emphasizing the intricate relationship between technology, psychology, and geopolitics. This comprehensive understanding serves as a cornerstone for evolving effective countermeasures and calls for an interdisciplinary research approach. The study also delves into the psychological motivations driving individuals towards illegal activities on the Darkweb, highlighting the urgency for targeted interventions to promote pro-social online behavior.
As blockchain technology continues to advance, the secure deployment of smart contracts has become increasingly prevalent, underscoring the critical need for robust security measures. This surge in usage has led to a rise in security breaches, often resulting in substantial financial losses for users. This article presents a comprehensive survey of smart contract quality assurance, from understanding vulnerabilities to evaluating the effectiveness of detection tools. Our work is notable for its innovative classification of 40 smart contract vulnerabilities, mapping them to established attack patterns. We further examine nine defense mechanisms, assessing their efficacy in mitigating smart contract attacks. Furthermore, we develop a labeled dataset as a benchmark encompassing 10 common vulnerability types, which serves as a critical resource for future research. We also conduct comprehensive experiments to evaluate 14 vulnerability detection tools, providing a comparative analysis that highlights their strengths and limitations. In summary, this survey synthesizes state-of-the-art knowledge in smart contract security, offering practical recommendations to guide future research and foster the development of robust security practices in the field.
Blockchain technology is leading a revolutionary transformation across diverse industries, with effective governance standing as a critical determinant for the success and sustainability of blockchain projects. Community forums, pivotal in engaging decentralized autonomous organizations (DAOs), wield a substantial impact on blockchain governance decisions. Concurrently, Natural Language Processing (NLP), particularly sentiment analysis, provides powerful insights from textual data. While prior research has explored the potential of NLP tools in social media sentiment analysis, a gap persists in understanding the sentiment landscape of blockchain governance communities. The evolving discourse and sentiment dynamics on the forums of top DAOs remain largely unknown. This paper delves deep into the evolving discourse and sentiment dynamics on the public forums of leading DeFi projects—Aave, Uniswap, Curve Dao, Aragon, Yearn.finance, Merit Circle, and Balancer—placing a primary focus on discussions related to governance issues. Despite differing activity patterns, participants across these decentralized communities consistently express positive sentiments in their Discord discussions, indicating optimism towards governance decisions. Additionally, our research suggests a potential interplay between discussion intensity and sentiment dynamics, indicating that higher discussion volumes may contribute to more stable and positive emotions. The insights gained from this study are valuable for decision-makers in blockchain governance, underscoring the pivotal role of sentiment analysis in interpreting community emotions and its evolving impact on the landscape of blockchain governance. This research significantly contributes to the interdisciplinary exploration of the intersection of blockchain and society, with a specific emphasis on the decentralized blockchain governance ecosystem. We provide our data and code for replicability as open access on GitHub.
Identity documentation for refugees is a complex process and crucial for host nations. A secured identity management system ensures both security and the efficient provision of services for the host nation and the donor organizations. Realizing the benefits, a handful of studies enriched the blockchain-based security identification for refugees. The research studies presented the introductory, conceptual, and practical solution related to the blockchain-based smart contract. There is a common agreement in the studies that blockchain-based smart contract not only streamlines refugee identity verification but also safeguards against unauthorized entries. Since it is a technology as well, it has been essential to know the present status of the technology in the social context. In such a situation it becomes essential to review the existing research studies to provide insight for future studies. In this study, we reviewed current studies using a thematic approach. Our findings suggest researchers are more inclined to provide conceptual models as the models are important in advancing technology; however, the models need to be implemented for practical advances. However, the main contribution of this study is that this study gathers current efforts in smart contract-based refugee identity management. This study is important for the refugee host nations as well as for stakeholders. Knowledge gained from the study is expected to provide insight into how the technology can be developed using existing theory and implementation frameworks.
In recent years, blockchain technology has witnessed rapid development and received considerable attention. However, its decentralized and pseudonymous nature has also attracted many criminal activities. Among them, Ponzi schemes, a classic form of financial fraud, also hide their true face in smart contracts, causing huge losses to blockchain users. Although numerous methods have been proposed to detect Ponzi contracts, these methods still have limitations in terms of generalization and feature learning. To address this issue, we conduct research on Ethereum, the currently largest blockchain platform enabling smart contracts, and propose a novel contrastive learning-based smart Ponzi scheme detection method named ContraPonzi. This method first extracts control flow graph information from bytecodes and models it as attribute graphs that preserve both semantic and structural information. Next, by augmenting the bytecode data of multi-version compilers and maximizing the graph representation similarity of multi-version bytecodes of the same contract, a pre-training graph encoder is obtained and then can be used in Ponzi contract detection. Experimental results on real-world data demonstrate that ContraPonzi is significantly superior to the state-of-the-art in Ethereum Ponzi scheme detection.
Abstract Security threats posed by Ponzi schemes present a considerably higher risk compared to many other online crimes. These fraudulent online businesses, including Ponzi schemes, have witnessed rapid growth and emerged as major threats in societies like Nigeria, particularly due to the high poverty rate. Many individuals have fallen victim to these scams, resulting in significant financial losses. Despite efforts to detect Ponzi schemes using various methods, including machine learning (ML), current techniques still face challenges, such as deficient datasets, reliance on transaction records, and limited accuracy. To address the negative impact of Ponzi schemes, this paper proposes a novel approach focusing on detecting Ponzi schemes on Ethereum using ML algorithms like random forest (RF), neural network (NN), and K-nearest neighbor (KNN). Over 20,000 datasets related to Ethereum transaction networks were gathered from Kaggle and preprocessed for training the ML models. After evaluating and comparing the three models, RF demonstrated the best performance with an accuracy of 0.94, a class-score of 0.8833, and an overall-score of 0.96667. Comparative evaluations with previous models indicate that our model achieves high accuracy. Moreover, this innovative work successfully detects key fraud features within the Ponzi scheme dataset, reducing the number of features from 70 to only 10 while maintaining a high level of accuracy. The main strength of this proposed method lies in its ability to detect clever Ponzi schemes from their inception, offering valuable insights to combat these financial threats effectively.
The phishing scams pose a serious threat to the ecosystem of Ethereum which is one of the largest blockchains in the world. Such a type of cyberattack recently has caused losses of millions of dollars. In this paper, we propose a Self-supervised IncrEmental deep Graph lEarning (SIEGE) model, for the phishing scam detection problem on Ethereum. To overcome the data scalability challenge, we propose splitting the original Ethereum transaction data and constructing transaction graphs for each split. Confronted with the minimal labeled data available, we resort to graph-based self-supervised learning. We design a spatial pretext task to learn high-quality node embeddings inside a single graph split, as well as an incremental learning paradigm and a temporal pretext task to facilitate information flow between different graph splits. To evaluate the effectiveness of SIEGE, we gather a real-world dataset consisting of six-month Ethereum transaction records. The results demonstrate that our model consistently outperforms baseline approaches in both transductive and inductive settings.
Blockchain technology has generated an influx of transaction data and complex interactions, posing significant challenges for traditional machine learning methods, which struggle to capture high-dimensional patterns in transaction networks. In this paper, we present the disentangled prototypical graph convolutional network (DP-GCN), an innovative approach to account classification in Ethereum transaction records. Our method employs a unique disentanglement mechanism that isolates relevant features, enhancing pattern recognition within the network. Additionally, we apply prototyping to disentangled representations, to classify scam nodes robustly, despite extreme class imbalances. We further employ a joint learning strategy, combining triplet loss and prototypical loss with a gamma coefficient, achieving an effective balance between the two. Experiments on real Ethereum data showcase the success of our approach, as the DP-GCN attained an F1 score improvement of 32.54%p over the previous best-performing GCN model and an area under the ROC curve (AUC) improvement of 4.28%p by incorporating our novel disentangled prototyping concept. Our research highlights the importance of advanced techniques in detecting malicious activities within large-scale real-world cryptocurrency transactions.
Zsofia Baruwa, Sanjay Bhattacherjee, Sahil Rey Chandnani, Zhen Zhu
This work is the first study on the effects of attacks on cryptocurrencies as expressed in the sentiments and emotions of social media users. Our goals are to design the methodologies for the study including data collection, conduct volumetric and temporal analyses of the data, and profile the sentiments and emotions that emerge from the data. As a first step, we have created a first-of-its-kind comprehensive list of 31 events of 51% attacks on various PoW cryptocurrencies, showing that these events are quite common contrary to the general perception. We have gathered Twitter data on the events as well as benchmark data during normal times for comparison. We have defined parameters for profiling the datasets based on their sentiments and emotions. We have studied the variation of these sentiment and emotion profiles when a cryptocurrency is under attack and the benchmark otherwise, between multiple attack events of the same cryptocurrency, and between different cryptocurrencies. Our results confirm some expected overall behaviour and reactions while providing nuanced insights that may not be obvious or may even be considered surprising. Our code and datasets are publicly accessible.
Due to the decentralized and transparent characteristics of the blockchain ecosystem, malicious activities such as phishing scams on the Ethereum platform result in significant financial losses for users. The current methods for detecting phishing largely rely on analyzing original transactions, which makes uncovering hidden transaction patterns challenging. To tackle this limitation, we introduce the Spatio-Temporal Fusion Network (STFN) designed to identify phishing scams on the Ethereum network. Specifically, STFN incorporates two key components: the transactions subgraph encoder for formalizing spatial features, and the transaction sequence BERT encoder for capturing temporal features. By fusing these spatio-temporal features, we facilitate their integration into a machine learning algorithm for classifying phishing accounts. The experimental outcomes underscore the effectiveness of the STFN, achieving an AUC of 93.26% and a Recall of 94.53%, outperforming previous methods for Ethereum phishing detection.
This paper presents the first comprehensive analysis of an emerging cryptocurrency scam named "arbitrage bot" disseminated on online social networks. The scam revolves around Decentralized Exchanges (DEX) arbitrage and aims to lure victims into executing a so-called "bot contract" to steal funds from them. To entice victims and convince them of this scheme, we found that scammers have flocked to publish YouTube videos to demonstrate plausible profits and provide detailed instructions and links to the bot contract. To collect the scam at a large scale, we developed a fully automated scam detection system namedCryptoScamHunter, which continuously collects YouTube videos and automatically detects scams. Meanwhile,CryptoScamHunter can download the source code of the bot contract from the provided links and extract the associated scam cryptocurrency address. Through deployingCryptoScamHunter from Jun. 2022 to Jun. 2023, we have detected 10,442 arbitrage bot scam videos published from thousands of YouTube accounts. Our analysis reveals that different strategies have been utilized in spreading the scam, including crafting popular accounts, registering spam accounts, and using obfuscation tricks to hide the real scam address in the bot contracts. Moreover, from the scam videos we have collected over 800 malicious bot contracts with source code and extracted 354 scam addresses. By further expanding the scam addresses with a similar contract matching technique, we have obtained a total of 1,697 scam addresses. Through tracing the transactions of all scam addresses on the Ethereum mainnet and Binance Smart Chain, we reveal that over 25,000 victims have fallen prey to this scam, resulting in a financial loss of up to 15 million USD. Overall, our work sheds light on the dissemination tactics and censorship evasion strategies adopted in the arbitrage bot scam, as well as on the scale and impact of such a scam on online social networks and blockchain platforms, emphasizing the urgent need for effective detection and prevention mechanisms against such fraudulent activity.