Zeta Avarikioti, Ray Neiheiser, Krzysztof Pietrzak, Michelle Yeo
Over the last years, Ethereum has evolved into a public platform that safeguards the savings of hundreds of millions of people and secures more than $650 billion in assets, placing it among the top 25 stock exchanges worldwide in market capitalization, ahead of Singapore, Mexico, and Thailand. As such, the performance and security of the Ethereum blockchain are not only of theoretical interest, but also carry significant global economic implications. At the time of writing, the Ethereum platform is collectively secured by almost one million validators highlighting its decentralized nature and underlining its economic security guarantees. However, due to this large validator set, the protocol takes around 15 minutes to finalize a block which is prohibitively slow for many real world applications. This delay is largely driven by the cost of aggregating and disseminating signatures across a validator set of this scale. Furthermore, as we show in this paper, the existing protocol that is used to aggregate and disseminate the signatures has several shortcomings that can be exploited by adversaries to shift stake proportion from honest to adversarial nodes. In this paper, we introduce Wonderboom, the first million scale aggregation protocol that can efficiently aggregate the signatures of millions of validators in a single Ethereum slot (x32 faster) while offering higher security guarantees than the state of the art protocol used in Ethereum. Furthermore, to evaluate Wonderboom, we implement the first simulation tool that can simulate such a protocol on the million scale and show that even in the worst case Wonderboom can aggregate and verify more than 2 million signatures within a single Ethereum slot.
Weihong Wang, Yana Dimova, Victor Vansteenkiste, Tom Van Goethem · 5 authors
Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures and provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem.
Blockchain technology and cryptocurrencies have attracted significant attention in recent years, yet remain susceptible to cyber threats such as phishing attacks. Existing detection approaches often suffer from high computational costs and limited robustness, especially when facing varying data distributions and sparse structures. To address these issues, we propose Robust, Node behavior, Transaction structure, and Network (R-NTN), a detection framework for Ethereum phishing accounts that leverages multi-dimensional transaction features. R-NTN first constructs 2-hop ego graphs via random walks, then extracts features from three complementary dimensions: behavioral attributes, transaction-based structural features, and network embeddings. These features are integrated into a unified representation for downstream classification. Experiments show that R-NTN consistently outperforms baseline methods and maintains high accuracy across datasets of different scales and compositions, demonstrating strong robustness and generalizability.
We report on a systematic measurement study of unauthenticated Ollama AI inference servers exposed on the public internet. Using passive enumeration via the Shodan Internet Intelligence Platform, we identify 20,971 publicly accessible Ollama endpoints and more than 54,000 total AI inference services across more than ten backend types, all reachable with no authentication. We conduct targeted proof-of-concept probing against three representative endpoints spanning enterprise cloud, residential broadband, and commercial VPS infrastructure across three countries (USA, Sweden, Austria). All three endpoints score maximum exploitability across five dangerous write operations (model deletion, arbitrary pull, push exfiltration, persistent model poisoning, and clone operations), zero security headers, and zero rate limiting. We document a previously unreported financial fraud vector arising from the proliferation of cloud API proxy models (:cloud suffix), through which unauthenticated access to an Ollama endpoint constitutes direct financial fraud against the endpoint owner's commercial AI API accounts. Extending beyond prior work, we characterize four Retrieval-Augmented Generation (RAG) layer PII exfiltration vectors that require no write access or special knowledge: (1) context-token session hijacking via /api/generate's persistent KV-cache state; (2) cleartext HTTP conversation history re-transmission; (3) co-deployed RAG database exposure; and (4) prompt-based RAG context extraction. In live testing, the fourth vector extracted 11 of 11 PII categories including financial credentials, medical diagnoses, and authentication passwords on the first plain-language prompt against a live production endpoint. We additionally identify a supply chain risk arising from shared model artifact digests across geographically separated endpoints, and a novel operator risk taxonomy distinguishing technically sophisticated but selectively insecure operators from the commonly assumed unaware operator class. All probing used entirely synthetic personal data. No real user conversations were accessed or retained. Responsible disclosure notices were sent to relevant ISPs prior to submission.
The rapid growth of Ethereum has enabled innovation in digital finance, smart contracts, and non-fungible tokens (NFTs) but it has also facilitated increasingly sophisticated phishing schemes. The existing fraud detection systems have limitations in addressing large-scale phishing involving multi-hop transaction patterns, rich edge metadata, extreme class imbalance, and hierarchical account organizations. This paper proposes a hierarchical multi-scale graph convolutional network (HMG-CN) that can: (1) adaptively fuse 1-3 hop convolutions to avoid over-smoothing, (2) perform edge-aware message passing conditioned on transaction attributes, (3) discover organizational structure via two-level hierarchical pooling, and (4) combine class-balanced focal loss with contrastive learning. In an experiment with a transaction graph with 805,327 nodes and 17.1 million directed edges derived from 47,123 labeled phishing addresses, HMG-CN outperformed classic machine learning (ML), graph embeddings, standard graph neural networks (GNNs), and recent phishing detectors across five different graph sizes. On 150,000 nodes, HMG-CN attained 0.943 F1 and 0.957 AUROC, exceeding the best baseline by 8.1% and 6.6%, respectively, uniquely improving its accuracy as the graph size increased. These results demonstrate that jointly modeling multi-scale structure, edges, and hierarchy yields scalable, accurate detection under low-prevalence conditions, providing a practical foundation for real-world blockchain security.
Alex J. Sinclair, Yuhan Zhang, Michael P. O’Connor, Li Wei
Graph Neural Networks (GNNs) have become the de facto standard for modeling blockchain transaction networks. However, standard GNN architectures predominantly operate under the assumption of homophily-that connected nodes share similar labels or features. This assumption catastrophically fails in the context of Ethereum phishing detection, a quintessential heterophilic learning problem where fraudsters (phishing accounts) actively connect with unlike victims (normal accounts) to facilitate theft. In this work, we argue that the "homophily bottleneck" in existing detection systems obscures critical high-frequency signals necessary for identifying illicit activity. We introduce the Heterophilic Semantic Graph Framework (HSGF), a novel architecture designed to decouple structural roles from feature smoothing. HSGF integrates a Motif-based Semantic Sampling (MSS) strategy to capture complex, directed transactional intents (e.g., dispersing, gathering, mixing) and a Heterophily-Aware Feature Fusion (HAFF) module that prevents the oversmoothing of fraudster representations into victim representations. Extensive experiments on real-world Ethereum datasets demonstrate that HSGF significantly outperforms state-of-the-art baselines, particularly in class-imbalanced scenarios, effectively breaking the ceiling imposed by traditional homophilic aggregation.
Phishing attacks pose significant risks to the Ethereum ecosystem, comprising over 50% of Ethereum-related cybercrimes, leading to the emergence of many machine learningbased defenses.This paper introduces a comprehensive framework aimed at enhancing machine learning-based phishing detection in Ethereum transactions.The framework addresses critical aspects such as feature selection, class imbalance, model robustness, and algorithm optimization.By systematically evaluating the strengths and limitations of existing approaches, we highlight gaps in current practices, particularly in feature manipulation and unsustainable performance outcomes.Through both analytical and experimental assessments, we demonstrate the framework's ability to streamline detection techniques, improving generalization and model effectiveness.Our findings emphasize the importance of refining detection strategies to meet the evolving challenges posed by sophisticated phishing schemes in the blockchain space.
LIU Ronglong, LI Ziwei, WAN Yue, WU Jiajing, JIANG Zigui
As the paradigm of ″decentralized next-generation Internet,″ Web3, relying on blockchain technology, has become an emerging field with great potential in the digital intelligence service ecosystem. However, Web3 phishing websites pose a serious threat to ecological health. Phishers carefully design domain names as the primary bait, inducing users to visit and engage in high-risk operations to steal digital assets. Currently, the antiphishing works of Web3 primarily focus on phishing account detection, phishing transaction detection, and phishing gang mining, whereas the existing phishing website domain name detection primarily targets traditional phishing websites, which have limitations such as insufficient adaptability and a lack of systematic analysis. To this end, a detection method called WPWHunter is proposed for Web3 phishing website domain names, which conducts multidimensional analysis on the detected real Web3 phishing websites and explores the potential application of Large Language Model (LLM) in web page analysis. The WPWHunter algorithm detects three features in Web3 phishing website domain names: inducing words, visual deception, and item name imitation. The experimental results show that WPWHunter can effectively detect suspicious Web3 phishing domains with a G-means index of 0.769 on a test set, which is 0.048 higher than that of the best-performing baseline method. Additionally, as a supplementary exploratory experiment, three universal LLM are used to analyze the content of Web3 phishing websites that WPWHunter failed to detect and the logic used by LLM to determine Web3 phishing websites is summarized.
As stablecoins become increasingly prevalent in financial crimes, their usage for illicit activities has reached a scale of USD 51.3 billion. Detecting phishing activities within stablecoin transactions has emerged as a critical challenge in blockchain security. Currently, existing detection methods predominantly target mainstream cryptocurrencies like Ethereum and lack specialized models tailored to the unique transaction patterns of stablecoin networks. This paper introduces a deep learning framework, BERTSC, based on multi-modal fusion. The model integrates three core modules graph convolutional networks (GCNs), BERT semantic encoders, and soft prompt encoders to identify malicious accounts. The GCN constructs directed multi-graph representations of account interactions, incorporating multi-dimensional edge features; the BERT encoder transforms discrete transaction attributes into semantically rich continuous vector representations; the soft prompt encoder maps account interaction features into learnable prompt vectors. An innovative three-way gated dynamic fusion mechanism optimally combines the information from these sources. The fused features are then classified to predict phishing account labels, facilitating the detection of phishing scams in stablecoin transaction datasets. Experimental results on large-scale stablecoin datasets demonstrate that BERTSC outperforms baseline models, achieving improvements of 4.96%, 3.60%, and 4.23% in Precision, Recall, and F1-score, respectively. Ablation studies validate the effectiveness of each module and confirm the necessity and superiority of the three-way gating fusion mechanism. This research offers a novel technical approach for phishing detection within blockchain stablecoin ecosystems.
Baoyu Zhang, Tao Chen, Weishan Zhang, Tao Wang · 9 authors
In September 2024, Lebanon was rocked by an unprecedented cyber-physical attack using Pager bombs. The attack combined advanced cyber warfare techniques with physical destruction, resulting in significant loss of life, infrastructure damage, and geopolitical repercussions. In this paper, we analyze the attitudes on this attack, from both English and Arabic social media users, and investigate impacts on global electronic devices sales and usage. A new topic discovery approach using large models and small models collaboration is proposed. We compare English and Arabic topics generated on social media and find that people in different language spaces share common topics of anxiety on this event. By analyzing market share trends in both China and the United States, an obvious correlation can be found between this event and phone sales. In addition, we discuss the evolution of warfare, and how DAOs(Decentralized Autonomous Organizations) can be utilized to improve the security of electronic devices by secured monitoring of their whole lifecycle.
How users adapt after being sandwiched remains unclear; this paper provides an empirical quantification. Using transaction level data from November 2024 to February 2025, enriched with mempool visibility and ZeroMEV labels, we track user outcomes after their n-th public sandwich: (i) reactivation, i.e., the resumption of on-chain activity within a 60-day window, and (ii) first-time adoption of private routing. We refer to users who do not reactivate within this window as churned, and to users experiencing multiple attacks (n>1) as undergoing repeated exposure. Our analysis reveals measurable behavioral adaptation: around 40% of victims migrate to private routing within 60 days, rising to 54% with repeated exposures. Churn peaks at 7.5% after the first sandwich but declines to 1-2%, consistent with survivor bias. In Nov-Dec 2024 we confirm 2,932 private sandwich attacks affecting 3,126 private victim transactions, producing \$409,236 in losses and \$293,786 in attacker profits. A single bot accounts for nearly two-thirds of private frontruns, and private sandwich activity is heavily concentrated on a small set of DEX pools. These results highlight that private routing does not guarantee protection from MEV extraction: while execution failures push users toward private channels, these remain exploitable and highly concentrated, demanding continuous monitoring and protocol-level defenses.
The web3 applications have recently been growing, especially on the Ethereum platform, starting to become the target of scammers. The web3 scams, imitating the services provided by legitimate platforms, mimic regular activity to deceive users. However, previous studies have primarily concentrated on de-anonymization and phishing nodes, neglecting the distinctive features of web3 scams. Moreover, the current phishing account detection tools utilize graph learning or sampling algorithms to obtain graph features. However, large-scale transaction networks with temporal attributes conform to a power-law distribution, posing challenges in detecting web3 scams. To overcome these challenges, we present ScamSweeper, a novel framework that emphasizes the dynamic evolution of transaction graphs, to identify web3 scams on Ethereum. ScamSweeper samples the network with a structure temporal random walk, which is an optimized sample walking method that considers both temporal attributes and structural information. Then, the directed graph encoder generates the features of each subgraph during different temporal intervals, sorting as a sequence. Moreover, a variational Transformer is utilized to extract the dynamic evolution in the subgraph sequence. Furthermore, we collect a large-scale transaction dataset consisting of web3 scams, phishing, and normal accounts, which are from the first 18 million block heights on Ethereum. Subsequently, we comprehensively analyze the distinctions in various attributes, including nodes, edges, and degree distribution. Our experiments indicate that ScamSweeper outperforms SIEGE, Ethident, and PDTGA in detecting web3 scams, achieving a weighted F1-score improvement of at least 17.29% with the base value of 0.59. In addition, ScamSweeper in phishing node detection achieves at least a 17.5% improvement over DGTSG and BERT4ETH in F1-score from 0.80.
ABSTRACT The proliferation of phishing scam tokens on the Ethereum blockchain, including honeypot, rug pull, and impersonation schemes, poses a grave threat to financial security. Although earlier studies have documented detection accuracies that exceed 95%, they frequently depend on random train‐test partitions. These partitions frequently overestimate real‐world performance by disregarding the temporal progression of phishing behaviors. This study addresses the methodological gap by employing a temporally validated evaluation. A labeled dataset comprising 5408 Ethereum token contracts was constructed. This dataset was verified through a two‐stage process that integrated cyber threat intelligence and on‐chain evidence. A total of 16 discriminative features were extracted, reflecting transaction volume, network structure, and temporal behavior. In lieu of employing random partitioning, temporal validation (70% training, 15% validation, and 15% testing) was adopted to assess generalizability to emerging threats. Six machine learning models (LightGBM, XGBoost, Random Forest, Gradient Boosting, Decision Tree, and MLP) were tuned via GridSearchCV. LightGBM demonstrated optimal performance, attaining 85.59% accuracy, 81.63% F1‐score, and 92.02% AUC on temporally held‐out data. The feature ablation process yielded the identification of transaction volume as the most discriminative factor, with a corresponding increase in performance of 13.09 points on the performance scale. Conversely, temporal features exhibited a marginal decline in performance, with a decrease of 0.87 points. Temporal validation resulted in a 3.95‐point‐percentage decrease compared to random splitting, thereby exposing the optimistic bias present in prior studies. Despite the fact that the resulting F1‐score of 81.63% falls short of the 85% threshold stipulated in the literature, it is indicative of a realistic deployment expectation. This work underscores the importance of temporal validation for reliable fraud detection research.
The decentralized and anonymous nature of Ethereum makes it a prime target for phishing scams. These scams account for nearly 50% of all blockchain-related fraud, thereby causing a substantial financial loss and eroding user trust. Unlike conventional phishing, Ethereum phishing users exploit user anonymity, lack of awareness, and market-driven dynamics to deceive normal users. Despite of a plethora of research in this direction, there is a lack of a rigorous and comprehensive survey which can fortify an insightful comparison of the existing works and provide a concrete future research guidance. To this end, this paper presents a systematic review of 90 studies published between 2020 and 2024, offering the following novel contributions, (1) Structured Taxonomy: We introduce a structured three-fold taxonomy that classifies existing methods into feature engineering-based, representation learning-based, and fusion-based frameworks. (2) Theoretical Analysis: Through theoretical analysis, we evaluate these approaches against the critical research challenges, such as rapid network dynamism, data leakage, and network sparsity and provide a comparative mapping of novel techniques adopted across the studies. (3) Empirical Evaluation: We conduct an extensive empirical evaluation of 14 representative models over multiple public datasets to assess their robustness under varying data conditions. The findings indicate that while feature-based models are more interpretable, they struggle with temporal adaptability; representation learning approaches, particularly GNN-based models, capture complex behavioral patterns but are computationally demanding and less explainable. Fusion methods demonstrate the most balanced trade-off between accuracy, scalability, and interpretability. (4) Future Research Guidance: Finally, we identify still persisting issues such as network sparsity, behavioral volatility, and scalability, and outline future research directions emphasizing temporal graph reasoning, self-supervised fusion, and explainable AI for developing transparent and deployable phishing detection frameworks on Ethereum.
In today’s technologically advancing world, many fields from finance to healthcare and education are shifting toward a digital and decentralized format. A significant transformation is underway with the currency of the masses. Blockchain-based cryptocurrencies like Bitcoin and Ethereum allow users to generate fungible tokens anonymously through smart contracts. However, these features also facilitate illicit transactions and cybercrimes like fraud, phishing, and money laundering. The proposed work explores the identification of suspicious transactions on the Ethereum blockchain by leveraging advanced machine-learning techniques. An Extreme Gradient Boosting (XGBoost) classifier is optimized for spotting unauthorized or malicious transactions, exploring features like transaction patterns and value anomalies. Feature scaling and log transformations normalize skewed distributions, while rigorous model training and hyperparameter tuning enhance the system's precision, recall, and overall accuracy. Other aids, such as feature importance rankings, precision-recall curves, and diagnostic statistics, provide useful information on fraud patterns. Evaluation of the model shows that integrating cost-sensitive learning significantly reduces false positives, from 51 to 44, representing a 13.7% decrease, which enhances practical usability by minimizing false alerts and manual verification efforts. Although there was a slight increase in false negatives (from 14 to 15), the overall classification accuracy improved. The model demonstrated strong performance in managing class imbalance which is common in fraud detection contexts.
Jianlong Xu, C. F. Xu, Rongtao Zhang, Feixiang Diao · 5 authors
With the wide application of blockchain technology in finance, IoT, healthcare, and other fields, phishing scams have emerged as a growing security threat. Existing detection methods often lack in-depth modeling of the directional properties of transaction flows and struggle to effectively capture diverse transaction behaviors, directional relationships, and key neighbor dependencies. To address these limitations, we propose TGAT-MPGCN, a direction-aware phishing detection model that constructs three complementary first-order subgraphs, a sending graph, a receiving graph, and a bidirectional graph to explicitly capture transaction directionality. By integrating a graph-attention mechanism with weighted neighbor aggregation, the model enhances feature learning. Experimental evaluations on an Ethereum transaction dataset demonstrate the superior performance of our approach, achieving an accuracy of 97.21%, an AUC of 0.9721, an F1-score of 0.9719, a recall of 0.9629, and a precision rate of 98.11%, significantly outperforming traditional detection methods. This study offers a practical and scalable solution for accurate phishing detection in blockchain transaction networks.
The prosperity of Ethereum gives rise to a new type of transaction-based phishing scam. Specifically, users are tempted to visit phishing websites and sign phishing transactions that allow scammers to withdraw their tokens. Meanwhile, to accelerate the deployment of phishing websites, scammers have introduced a business model, Drainer-as-a-Service (DaaS). In this model, drainer operators focus on crafting specialized phishing toolkits, named ''wallet drainers'', while drainer affiliates handle the deployment and promotion of phishing websites. After stealing victims' tokens, they will distribute profits. In this paper, we present the first systematic study of DaaS on Ethereum. To begin with, we propose a snowball sampling approach to build the first large-scale DaaS dataset, including 1,910 profit sharing contracts, 56 operator accounts, 6,087 affiliate accounts, and 87,077 profit-sharing transactions. Then, we analyze the scale of DaaS from the perspectives of victims, operators, and affiliates, and perform clustering analysis to uncover dominant DaaS families. Finally, we reported DaaS accounts in the dataset and 32,819 phishing websites deployed with DaaS toolkits to the community. Our work aims to serve as a guide for Ethereum service providers to enhance user protection against DaaS.
Luis de‐Marcos, Adrián Domínguez‐Díaz, Javier Junquera-Sánchez, Carlos Cilleruelo · 5 authors
The Dark Web, a hidden segment of the internet, has become a hub for illicit activities, facilitated by various forms of digital identification (IDs) such as email addresses, Telegram accounts, and cryptocurrency wallets. This study conducts a comprehensive analysis of the Dark Web’s identification and communication patterns, focusing on the roles of different ID types and their associated activities. Using a dataset of Dark Web documents, we construct and analyze a bipartite network to model the relationships between IDs and web documents, employing graph–theoretical metrics such as degree centrality, closeness centrality, betweenness centrality, and k-core decomposition, while analyzing subnetworks formed by ID type. Our findings reveal that Telegram forms the backbone of the network, serving as the primary communication tool for hacking-related activities, particularly within Russian-speaking communities. In contrast, email plays a more decentralized role, facilitating finance–crypto and other activities but with a high level of fragmentation and English as the predominant language. XMR (Monero) wallets emerge as a key component in financial transactions, forming a cohesive subnetwork focused on cryptocurrency-related activities. The analysis also highlights the modular and hierarchical nature of the Dark Web, with distinct clusters for hacking, finance–crypto, and drugs–narcotics, often operating independently but with some cross-topic interactions. This study provides a foundation for understanding the Dark Web’s structure and dynamics, offering insights that can inform strategies for monitoring and mitigating its risks.
Phishing attacks in Web3 ecosystems are increasingly sophisticated, exploiting deceptive contract logic, malicious frontend scripts, and token approval patterns. We present DeepTx, a real-time transaction analysis system that detects such threats before user confirmation. DeepTx simulates pending transactions, extracts behavior, context, and UI features, and uses multiple large language models (LLMs) to reason about transaction intent. A consensus mechanism with self-reflection ensures robust and explainable decisions. Evaluated on our phishing dataset, DeepTx achieves high precision and recall (demo video: https://youtu.be/4OfK9KCEXUM).
A blockchain-enabled Model integrates blockchain technology with Intrusion Detection Systems to enhance the security of Internet of Things (IoT) networks. It ensures data integrity, decentralization, and tamper-proof logging of intrusion detection. The approach improves trust, transparency, and real-time threat detection in distributed IoT environments. The existing blockchain-based IDS approaches, Blockchain Enabled (BCE-IoT), uniquely integrate blockchain consensus with federated-style local training, lightweight cryptography, and Shapley Additive Explanations (SHAP)-based explainability, ensuring both security and interpretability in IoT environments. The proposed work combines Blockchain technology with explainable artificial intelligence solutions to create a new cybersecurity Model that strengthens intrusion detection within IoT networks. The proposed model enhances transparency in tracking cyberattacks by combining blockchain security storage capabilities with SHAP, an explainable AI. This research utilises machine learning and artificial intelligence to detect threats in real-time, countering Distributed Denial of Service (DDoS), Denial of Service (DoS), scanning, Cross-Site Scripting (XSS), injection, password, and backdoor attacks. BCE-IoT delivers more precise security by combining blockchain’s permanent data features and AI anomaly detectors, thereby reducing security alert mistakes. The performance effectiveness of Blockchain-Enabled IoT surpasses that of the Content Integrity Detection System. It combines Blockchain and Software-Defined Networking to enhance security in network environments, utilising blockchain-based mutual confirmation for software-defined networking to detect and block cyber threats. The evaluation establishes BCE-IoT as an effective IoT network security solution that delivers strong cybersecurity features, is adaptable to modern connected environments, and offers interpretable security solutions. The performance evaluations demonstrate that BCE-IoT provides a robust, flexible, and interpretable cybersecurity solution suitable for modern IoT environments.
Xihan Xiong, Zhipeng Wang, Qin Wang, William Knottenbelt
Decentralized communication is becoming an important use case within Web3. On Ethereum, users can repurpose the transaction input data field to embed natural-language messages, commonly known as Input Data Messages (IDMs). However, as IDMs gain wider adoption, there has been a growing volume of toxic content on-chain. This trend is concerning, as Ethereum provides no protocol-level support for content moderation. We propose two moderation frameworks for Ethereum IDMs: (i) BUILDERMOD, where builders perform semantic checks during block construction; and (ii) USERMOD, where users proactively obtain moderation proofs from external classifiers and embed them in transactions. Our evaluation reveals that BUILDERMOD incurs high block-time overhead, which limits its practicality. In contrast, USERMOD enables lower-latency validation and scales more effectively, making it a more practical approach in moderation-aware Ethereum environments. Our study lays the groundwork for protocol-level content governance in decentralized systems, and we hope it contributes to the development of a decentralized communication environment that is safe, trustworthy, and socially responsible.
The unique International Mobile Equipment Identity (IMEI) number is essential for identifying mobile devices and blacklisting stolen ones within networks. Current solutions are limited to local blacklists and lack a global mechanism for information exchange among operators. Efforts by the Global System for Mobile Communications Association (GSMA) to implement a common blacklist have been constrained by costs, resulting in fragmented and ineffective IMEI management systems. To address these challenges, we have developed a blockchain-based framework that uses the decentralized consensus and tamper-proof nature of distributed ledger technology to enable a unified and globally accessible IMEI blacklist. The framework is implemented on a permissioned blockchain deployed on the Sepolia testnet, utilizing the Proof of Authority (PoA) consensus mechanism to ensure fast and secure validation in a multi-stakeholder environment. Our solution includes a Decentralized Application (DApp) for user interaction, with smart contracts deployed using a Web3 wallet and connected via the Alchemy API to enable efficient communication between the front end and blockchain. Smart contracts automate device status verification, theft reporting, and transaction recording, enhancing transparency, accountability, and security in mobile device management. To validate IMEI numbers, the system uses the Luhn algorithm, a widely accepted checksum method. The framework also collaborates with law enforcement and insurance companies to improve theft verification and claims processing. Experimental results demonstrate the framework's scalability, achieving low latency of under 1 second at transaction rates up to 1,000 TPS and reducing transaction processing time by 30% compared to a traditional centralized database-based system. Performance outcomes were validated through 30 independent test runs to account for variability, underscoring the framework's robustness and potential for widespread adoption. These results set a new standard for global mobile device security through industry-wide collaboration.
Maruf Farhan, Usman Butt, Rejwan Bin Sulaiman, Mansour Naser Alraja
The widespread circulation of digital misinformation exposes a critical shortcoming in prevailing detection strategies, namely, the absence of robust mechanisms to confirm the origin and authenticity of online content. This study addresses this by introducing VeriTrust, a conceptual and provenance-centric framework designed to establish content-level trust by integrating Self-Sovereign Identity (SSI), blockchain-based anchoring, and AI-assisted decentralized verification. The proposed system is designed to operate through three key components: (1) issuing Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) through Hyperledger Aries and Indy; (2) anchoring cryptographic hashes of content metadata to an Ethereum-compatible blockchain using Merkle trees and smart contracts; and (3) enabling a community-led verification model enhanced by federated learning with future extensibility toward zero-knowledge proof techniques. Theoretical projections, derived from established performance benchmarks, suggest the framework offers low latency and high scalability for content anchoring and minimal on-chain transaction fees. It also prioritizes user privacy by ensuring no on-chain exposure of personal data. VeriTrust redefines misinformation mitigation by shifting from reactive content-based classification to proactive provenance-based verification, forming a verifiable link between digital content and its creator. VeriTrust, while currently at the conceptual and theoretical validation stage, holds promise for enhancing transparency, accountability, and resilience against misinformation attacks across journalism, academia, and online platforms.
Ch. Rupa, Sai Varshitha. G, D Divya, Thippa Reddy Gadekallu · 6 authors
The world faces a severe blood shortage, with a gap of 1.95 million units, highlighting the need for efficient blood allocation and management systems. Traditional cloud and blockchain approaches have been explored for blood bank management but faced implementation challenges. This study proposes designing and developing a decentralized Binance blockchain-based application framework to ensure transparency and security. It uses the AdaBoost algorithm to predict the availability of the nearest blood bank and blood donor. Supply chain management provides transparency without the intervention of third parties thereby preventing blood crimes. Metamask is incorporated for crypto transactions in the Binance Smart Chain test network (BSC). BSC stands out for its low transaction fees and high scalability, enabling swift transaction processing at a fraction of the cost compared to Ethereum. The smart contracts are deployed using hardhat configuration enabling BscScan as an Application Programming Interface (API) gateway to record transactions within the decentralized application (dApp). The proposed system achieved an accuracy of 99.5%, demonstrating the robustness of the AdaBoost model in predicting blood availability. The integration of blockchain technology ensures transparency, immutability, and secure traceability of blood transactions across the network.