Blockchain smart contracts are pivotal to decentralized applications, yet their security remains a critical challenge. This study analyzes a dataset of 1,000 smart contracts to investigate known vulnerabilities, audit practices, and exploit patterns. The results reveal that audited contracts are significantly less prone to exploitation, with 75% exhibiting no exploit history compared to 55% of non-audited contracts. "Integer Overflow" and "Unchecked Call" were identified as the most prevalent vulnerabilities, contributing to 60% and 50% exploit rates, respectively. The study highlights the importance of transparent audit reporting, as contracts without available reports were exploited in 35% of cases. Additionally, hidden vulnerabilities in ostensibly secure contracts underscore the evolving sophistication of blockchain threats. This research emphasizes the need for robust security practices, including stricter coding standards, comprehensive audits, and advanced vulnerability detection techniques such as formal verification and machine learning. Future works aim to integrate security tools into development workflows and foster industry-wide collaboration to standardize auditing practices, thereby enhancing the security and trustworthiness of blockchain ecosystems.
Humans have the ability to incrementally learn, accumulate, update, and apply knowledge from dynamic environments. This capability, known as continual learning or lifelong learning, is also a long-term goal in the development of artificial intelligence. However, neural network-based continual learning suffers from catastrophic forgetting: the acquisition of new knowledge typically disrupts previously learned knowledge, leading to partial forgetting and a decline in the model’s overall performance. Most current continual learning methods can only mitigate catastrophic forgetting and fail to incrementally improve the overall performance. In this work, we aim to incrementally improve performance within sample incremental context by utilizing inter-stage edges as a pathway for explicit knowledge transfer in continual graph learning. Building on this pathway, we propose a knowledge-augmented replay method by leveraging evolving subgraphs of important nodes. This method enhances the distinction between patterns associated with different node classes and consolidates previously learned knowledge. Experiments on phishing detection in Ethereum transaction networks validate the effectiveness of the proposed method, demonstrating effective knowledge retention and augmentation while overcoming catastrophic forgetting and incrementally improving performance. The results also reveal the relationship between average accuracy and average forgetting. Lastly, we identify the key factor to incremental performance improvement, which lays a foundation for convergence of continual graph learning.
This paper addresses the problem of detecting money laundering in the Bitcoin network. Money laundering is the process of handling the proceeds of crime to conceal their illegal source, these illicit transactions have complex features, similar to those of legal transactions. It is well known that transactions can be represented as topological graph structure data, and many GCN-based methods have been developed for Anti-Money Laundering (AML) tasks. However, existing methods have not performed as well in dynamically assigning weights to neighboring nodes and extracting information from global nodes in the Bitcoin network. Therefore, we identify three major challenges: Firstly, GCNs can be misled by concealed illegal transactions due to uniform node representation weights. Secondly, current node-level GCNs cannot handle varied methods of concealing illegal transactions because they fail to extract global information. Thirdly, the costliness of data labelling necessitates the effective use of limited but rich domain-specific labelled data. To address these challenges, we propose the Transformer-enhanced Graph Attention Network (TFGAT) with a Global-Local Attention Mechanism (GLATM) that uses Transformers to extract global information and selectively focus on local information from connected nodes. Due to the limited availability of labelled data from expensive data labelling processes, we introduce a Deep Cyclic Pseudo-Label Updating Mechanism (DCPLU) to enhance data distribution and model robustness, which does not rely on manifold structure or Euclidean distance assumptions. DCPLU can enhance model performance while preserving the model's existing parameters, enabling it to maintain its current faster response time in the application scenario. Experimental results show that our methods outperform existing models across various metrics.
Background: Cryptocurrency is a digital decentralized currency that enables peer-to-peer transactions without the involvement of intermediaries, using blockchain technology to ensure security and transparency. These emotions can help understand when and what behavioral intentions toward cryptocurrency adoption are necessary. These insights contribute to the growing literature on fintech adoption in emerging economies and provide valuable guidance for policymakers and investors formulating cryptocurrency regulations in Nepal. Objectives: It aims to investigate the influence of perceived usefulness, perceived ease of use, trust, and perceived risk constructs attached to an individual's intention to be involved in cryptocurrency transactions. It finally aims to study the relationships among these variables and their effect on cryptocurrency adoption in the Nepal context. Methods: The study uses a quantitative descriptive design and snowball sampling alone to extract information from cryptocurrency users in Nepal. A structured online questionnaire was used to gather 272 responses and analyzed using correlation and regression to investigate the significance of the proposed hypotheses. Results: Findings show that perceived usefulness, ease, or trust significantly and positively influence behavioral intention toward cryptocurrency adoption, while perceived risk harms adoption because users worry about market volatility, regulatory uncertainty, and security threats. Despite the government's legal restrictions, many Nepalese citizens are still involved in cryptocurrency transactions, seeing it as a source of financial benefit and investment opportunity. Conclusion: The study attests that perceived usefulness, perceived ease of use, and trust motivate behavior toward adopting cryptocurrency, while perceived risk provides a barrier. This enlightens policymakers on balanced regulatory measures that address risks while encouraging innovation in digital finance. These findings would provide valuable implications for policymakers, financial institutions, and technology developers in outlining the future of cryptocurrency regulation and adoption strategies. JEL Classification: D14, E42, G41
Chunhong Liu, Zihang Sang, Li Duan, Jingxiong Wang · 6 authors
Security vulnerabilities in smart contracts can have severe economic consequences. Existing smart contract vulnerability detection methods rely primarily on rigid rules defined by experts and have difficulty in detecting unknown vulnerabilities. This article proposes a new Anomalous Smart Contract Detector, named ASCD, to effectively detect known and unknown vulnerabilities in smart contracts. This is achieved by interpreting unknown vulnerabilities as code anomalies and detecting them with an anomaly detection technique named DeepSVDD. This is also attributed to a new design of feature extraction, in which we compile smart contract source codes into opcodes, extract semantic features from opcode sequences, and control flow features from control flow graphs. By joining LSTM and GIN, the semantic and control flow features are fused to offer a comprehensive representation of smart contracts suitable for anomaly detection. Extensive experiments were conducted to verify the ASCD model, and more than 30,000 smart contracts were tested. The new model offers a significantly better F1-score than existing methods in detecting known vulnerabilities and achieves a high accuracy of 77% in detecting unknown vulnerabilities.
The Ethereum Virtual Machine (EVM) is a decentralized computing engine. It enables the Ethereum blockchain to execute smart contracts and decentralized applications (dApps). The increasing adoption of Ethereum sparked the rise of phishing activities. Phishing attacks often target users through deceptive means, e.g., fake websites, wallet scams, or malicious smart contracts, aiming to steal sensitive information or funds. A timely detection of phishing activities in the EVM is therefore crucial to preserve the user trust and network integrity. Some state-of-the art approaches to phishing detection in smart contracts rely on the online analysis of transactions and their traces. However, replaying transactions often exposes sensitive user data and interactions, with several security concerns. In this work, we present PhishingHook, a framework that applies machine learning techniques to detect phishing activities in smart contracts by directly analyzing the contract’s bytecode and its constituent opcodes. We evaluate the efficacy of such techniques in identifying malicious patterns, suspicious function calls, or anomalous behaviors within the contract’s code itself before it is deployed or interacted with. We experimentally compare 16 techniques, belonging to four main categories (Histogram Similarity Classifiers, Vision Models, Language Models and Vulnerability Detection Models), using 7,000 real-world malware smart contracts. Our results demonstrate the efficiency of PhishingHook in performing phishing classification systems, with about 90% average accuracy among all the models. We support experimental reproducibility, and we release our code and datasets to the research community.
T. C. Jermin Jeaunita, Thiyagarajan Ramesh, C. V. Manjushree, P. T. Shantala
Crowdfunding has become essential for financing entrepreneurial projects, innovative projects, and social initiatives.However, existing platforms face critical challenges, including a lack of transparency, low user engagement, data privacy concerns, and ineffective personalization of user experiences.To address these limitations, this study introduces a novel decentralized crowdfunding framework that integrates Federated Learning (FL), blockchain technology, and Q-learning to enhance security, transparency, and user engagement.The framework leverages FL to collaboratively train models across distributed datasets while ensuring privacy preservation by eliminating the need to share raw user data.Blockchain technology is utilized to ensure tamper-proof transaction records and automate trustless interactions through smart contracts, effectively preventing fraud while increasing transparency.Additionally, a Q-learning-based incentive mechanism is incorporated to predict and stimulate user engagement, ensuring dynamic long-term engagement.The experimental evaluation illustrates that the designed framework attains state-of-the-art performance with an accuracy rate of 99.39%, surpassing existing methodologies.The results demonstrate the effectiveness of the framework in providing a secure, decentralized, and highly personalized crowdfunding system, raising trust and engagement among stakeholders and resolving long-standing issues in crowdfunding platforms.
Zsofia Baruwa, Sanjay Bhattacherjee, Sahil Rey Chandnani, Zhen Zhu
This work is the first study on the perceptions of social media users about cryptocurrency attacks. The double-spending or 51% attack being the most fundamental attack on cryptocurrencies, it is the focus of this study. As a first step, we create a first-of-its-kind comprehensive list of 31 events of 51% attacks on various proof-of-work cryptocurrencies, showing that these events are quite common. This list contradicts the general perception about the security of cryptocurrencies, particularly portrayed in the Executive Order establishing a Strategic Bitcoin Reserve and a Digital Asset Stockpile in the US. We design the methodologies for our new study of user perceptions around these attacks. We create datasets containing tweets from the time of the attack events, and compare them with benchmark data from normal times. We define parameters for profiling these datasets based on user perceptions – sentiments and emotions. We study the variation of these perception profiles, when a cryptocurrency is under attack and the benchmark otherwise, between multiple attack events of the same cryptocurrency, and between different cryptocurrencies. Our results confirm some expected overall behaviour and reactions while providing nuanced insights that may not be obvious or may even be considered surprising. Our code and datasets are publicly accessible.
This study explores the intricate relationship between public sentiment and Bitcoin market dynamics, leveraging sentiment analysis of Twitter data to uncover patterns in emotional discourse surrounding cryptocurrency. By analyzing sentiment trends from 2013 to 2019, the research reveals a cyclical interplay between positive and negative sentiment, often aligning with Bitcoin’s dramatic price movements. Positive sentiment peaks coincide with periods of market optimism, driven by narratives of technological innovation and mainstream adoption, while negative sentiment troughs reflect moments of fear, uncertainty, and doubt (FUD) during market corrections. Despite the observed alignment, the correlation between sentiment and Bitcoin prices remains weak, underscoring the complexity of market behavior and the influence of external factors such as macroeconomic trends and regulatory developments. The findings highlight the potential of sentiment analysis as a complementary tool for market prediction, offering valuable insights into the emotional undercurrents that shape cryptocurrency markets. This study contributes to a deeper understanding of the socio-economic and psychological dimensions of Bitcoin, providing a foundation for future research in sentiment-driven market analysis.
Bassam W. Aboshosha, M.A. Zayed, Hany S. Khalifa, Rabie Α. Ramadan
Abstract Background The rapid expansion of Internet of Things applications in healthcare has created new opportunities for improving patient care through real-time monitoring and data sharing. However, this growth also introduces significant challenges related to data security, privacy, and system efficiency, especially for devices with limited processing power and energy resources. To address these issues, this study introduces a blockchain-based lightweight hashing system specifically designed for healthcare environments with resource-constrained devices. The goal is to ensure secure, efficient, and scalable handling of sensitive medical data without overwhelming the capabilities of connected devices. Results The proposed system combines a collision-resistant, lightweight hash function with blockchain technology to enhance data integrity, authentication, and privacy. The hash function minimizes computational demands, making it ideal for wearable and embedded healthcare devices. Blockchain integration enables decentralized data management, preventing unauthorized access and tampering. The system generates unique, immutable patient identifiers and protects electronic health information from common security threats, including collision attacks, Sybil attacks, and cryptographic analysis. Simulation results show improved computational efficiency, lower latency, and effective handling of high transaction volumes with minimal resource usage. Conclusions This research presents a secure and efficient framework for managing medical data in healthcare Internet of Things applications. By leveraging lightweight cryptographic techniques and decentralized data structures, the system addresses key limitations in current solutions while supporting scalability and real-world deployment. Potential applications include secure patient monitoring, real-time sharing of health data, and decentralized management of medical records. The proposed approach provides a foundation for future advancements in digital healthcare systems, particularly in remote care, emergency response, and wearable health technologies.
The prosperity of Ethereum has led to a rise in phishing scams. Initially, scammers lured users into transferring or granting tokens to Externally Owned Accounts (EOAs). Now, they have shifted to deploying phishing contracts to deceive users. Specifically, scammers trick victims into either directly transferring tokens to phishing contracts or granting these contracts control over their tokens. Our research reveals that phishing contracts have resulted in significant financial losses for users. While several studies have explored cybercrime on Ethereum, to the best of our knowledge, the understanding of phishing contracts is still limited. In this paper, we present the first empirical study of phishing contracts on Ethereum. We first build a sample dataset including 790 reported phishing contracts, based on which we uncover the key features of phishing contracts. Then, we propose to collect phishing contracts by identifying suspicious functions from the bytecode and simulating transactions. With this method, we have built the first large-scale phishing contract dataset on Ethereum, comprising 37,654 phishing contracts deployed between December 29, 2022 and January 1, 2025. Based on the above dataset, we collect phishing transactions and then conduct the measurement from the perspectives of victim accounts, phishing contracts, and deployer accounts. Alarmingly, these phishing contracts have launched 211,319 phishing transactions, leading to 190.7 million in losses for 171,984 victim accounts. Moreover, we identify a large-scale phishing group deploying 85.7% of all phishing contracts, and it remains active at present. Our work aims to serve as a valuable reference in combating phishing contracts and protecting users' assets.
Ever since its inception in 2008, Blockchain technology has been widely used in most industries to ensure data security and authenticity. From Bitcoin to Blockchain-as-a-Service (BaaS), it has been increasingly adopted. Counterfeiting is one of the biggest issues that companies are fighting, impacting revenues, brand value, and customer trust. In this review, a decentralized Blockchain- based supply chain solution to ensure product authenticity without third-party dependency is discussed. Through the use of distributed ledger technology, authentic and fake products can be identified at all levels. Unique QR codes, produced by the system proposed here with SHA-256, provide transparency and traceability to each product. Blockchain-based anticounterfeiting mechanism provides a secure, tamper-evident method of proving product authenticity, allowing organizations to uphold integrity in their supply chain.
This paper examines the dynamics of trust and bot-driven responses within the meme coin ecosystem on the Solana blockchain, with a particular emphasis on the interplay between social media-induced sentiment and on-chain transaction behaviors.Meme coins, which originate from internet culture and are heavily influenced by community sentiment, represent a volatile and distinct category of cryptocurrencies.Employing sentiment propagation networks, on-chain transaction data, and sentiment-transaction integrated models, we quantitatively analyze the relationship between emotional fluctuations and market behaviors.By contrasting Rug Pull scams with sustainable projects, we identify critical differences in the role of sentiment across different phases of project development.Our findings reveal three distinct sentiment-driven user trading behaviors: sentiment followers, makers, and stabilizers.The results indicate that, while sentiment is a primary driver of early-stage trading within Rug Pull projects, its influence diminishes as community distrust intensifies, resulting in more opportunistic and reactive trading patterns.This study contributes to the understanding of the co-evolution of memes, sentiment, and market dynamics, offering new insights into the complexities of decentralized finance ecosystems, with a specific focus on Solana-based meme coin markets.
S. M. Dilip Kumar, Namrta Tanwar, Namrta Tanwar, Aakarsh Chandna · 5 authors
The blockchain technology has disrupted the earlyage digital banking through concepts like bitcoin and ether [1,3].In this study, some major elements of the blockchain technology are examined-decentralized networks, smart contracts, cryptographic techniques, and consensus mechanisms of Proof of Work and Proof of Stake usage-and understanding how they contribute to safe, peer-to-peer transactions without intermediaries [2,5].Bitcoin can do no more than about seven transactions a second (TPS) is a very paltry competition of an impressive 30 to 40 TPS of Ethereum.This depicts the ongoing scalability challenges that need to be tackled by initiatives linked with Ethereum 2.0 and the Lightning Network [4,9].While most industries, apart from banking, have effectively made their blockchain applications and transparency useful-Supply Chain Management, Healthcare, and DeFi-currently poses challenges of transaction speed limitations, the vagueness of regulations, and energy consumption by mining [8].Emerging trends include Non-Fungible Tokens (NFTs), Central Bank Digital Currencies (CBDCs), and privacy enhanced through zero-knowledge proofs.There is hope for excellent feedback on the future of the blockchain from these and other initiatives yet to come into reality.
Information disorder has become a major societal challenge, impacting public discourse and democracy. This phenomenon has been exacerbated by the spread of social media platforms, affecting various areas, ranging from national elections to public health. Addressing fake news through a manual approach (e.g., human fact-checking) is unfeasible due to the rapid production of textual content. At the same time, applying automatic tools is equally challenging, primarily due to the ambiguity of natural language. In this paper, we addressed online information disorder from a different perspective by proposing a platform that supports trustworthy and reputable news producers and enhances awareness among readers across various social media. Specifically, the proposed platform enables news producers to automatically embed a unique watermark in the text they create, ensuring that the news cannot be manipulated or misattributed. The watermarking is embedded in a fine-grained way, allowing even small extracts of the news to be shared while preserving traceability. Additionally, the association between the watermark and the news item is recorded in a distributed ledger, preventing further manipulation that could arise from centralised management. The aim is to enable readers to make more informed decisions about the content they encounter, even when engaging with excerpts of the original document, minimising reliance on external fact-checking organisations.
This paper explores the vulnerability of machine learning models to simple single-feature adversarial attacks in the context of Ethereum fraudulent transaction detection. Through comprehensive experimentation, we investigate the impact of various adversarial attack strategies on model performance metrics. Our findings, highlighting how prone those techniques are to simple attacks, are alarming, and the inconsistency in the attacks' effect on different algorithms promises ways for attack mitigation. We examine the effectiveness of different mitigation strategies, including adversarial training and enhanced feature selection, in enhancing model robustness and show their effectiveness.
Phishing detection on Ethereum has increasingly leveraged advanced machine learning techniques to identify fraudulent transactions. However, limited attention has been given to understanding the effectiveness of feature selection strategies and the role of graph-based models in enhancing detection accuracy. In this paper, we systematically examine these issues by analyzing and contrasting explicit transactional features and implicit graph-based features, both experimentally and analytically. We explore how different feature sets impact the performance of phishing detection models, particularly in the context of Ethereum's transactional network. Additionally, we address key challenges such as class imbalance and dataset composition and their influence on the robustness and precision of detection methods. Our findings demonstrate the advantages and limitations of each feature type, while also providing a clearer understanding of how feature affect model resilience and generalization in adversarial environments.
In recent years, the Ethereum Name Service (ENS) has garnered significant attention within the community for enabling the use of Unicode in domain names, thereby facilitating the inclusion of a wide array of character sets such as Greek, Cyrillic, Arabic, and Chinese. While this feature enhances the versatility and global accessibility of domain names, it concurrently introduces a substantial security vulnerability due to the presence of homoglyphs-characters that are visually similar to others across Unicode and ASCII sets. These similarities can be exploited in homoglyph attacks, posing a distinct threat to domain name integrity. Despite community efforts to counteract this issue through a normalization process prior to domain resolution, our analysis uncovers significant discrepancies in how the normalization processes are applied across various applications. This inconsistency could result in the same domain name being resolved to different addresses in different applications, underscoring a critical vulnerability. We also discovered the new attack scenario in ENS which may cause legitimate domains resolved into malicious addresses even when they are verified by authorities. To systematically evaluate this inconsistency, we designed a tool for detecting application-level discrepancies in domain normalization process without requiring access to the application's source code. Our evaluation on hundreds of real-world Web3 applications identifies widespread deviations from established homoglyph mitigation practices, with more than 60% digital wallets and 80% dApps (decentralized applications) not able to produce consistent ENS resolving results, potentially impacting millions of users. This analysis underscores the urgent need for a standardized implementation of normalization processes to safeguard the integrity and security of ENS domains.
M. K. Ghosh, Swapnil Srivastava, Apoorva Upadhyaya, Raju Halder · 5 authors
Phishing scams on Ethereum have expanded with the surge of the platform, posing substantial challenges due to the sheer similarity in user behaviours and sparse temporal instances. Current methods often fail to tackle these concerns and overlook the temporal sequence of transactions, resulting in suboptimal performance. In this paper, we aim to address these gaps by focusing on the alignment of two aspects: (1) User-specific local temporal behavior, and (2) Divergences from global activity patterns of the network. Hence, we introduce CATALOG (CApturing joint TemporAl dependencies from LOcal and Global user behaviour), a novel representation learning model that jointly captures the local and global user behviours and their correlations by leveraging a dual cross-attention mechanism paired with a bi-directional Masked Language Modelling (MLM) transformer. Our proposed model simultaneously learns from local behavioral shifts, global market trends, and contextually enriched embeddings, effectively distinguishing phishing from non-phishing users while addressing existing research gaps. Extensive experiments on real-world Ethereum transaction data show that our framework improves phishing detection by 7-8% in the F1-Score along with demonstrating the generalization to Ethereum versions 1.0 and 2.0.
Kai Ma, Ningyu He, Jintao Huang, B. X. Zhang · 6 authors
Cybersquatting refers to the practice where attackers register a domain name similar to a legitimate one to confuse users for illegal gains. With the growth of the Non-Fungible Token (NFT) ecosystem, there are indications that cybersquatting tactics have evolved from targeting domain names to NFTs. This paper presents the first in-depth measurement study of NFT cybersquatting. By analyzing over 220K NFT collections with over 150M NFT tokens, we have identified 8,019 cybersquatting NFT collections targeting 654 popular NFT projects. Through systematic analysis, we discover and characterize seven distinct squatting tactics employed by scammers. We further conduct a comprehensive measurement study of these cybersquatting NFT collections, examining their metadata, associated digital asset content, and social media status. Our analysis reveals that these NFT cybersquatting activities have resulted in a significant financial impact, with over 670K victims affected by these scams, leading to a total financial exploitation of $59.26 million. Our findings demonstrate the urgency to identify and prevent NFT squatting abuses.
Pieter Hartel, Marianne Junger, Mark van Staalduinen
Abstract Objective This study examines Bitcoin generator (BG) websites on the clear and dark web. It focuses on their prevalence, revenue, and associated warnings, as these sites are suspected scams. Method Data for the study was gathered from the Dark Web Monitor and Iknaio Cryptoasset Analytics. A four-step process was used to identify BG sites and their Bitcoin addresses from 2 million dark websites. Results We found 832 dark web BG sites. The monetary revenue from a dark web BG site is approximately 1/3 smaller per Bitcoin address than from a clear web BG site. There is a concentration of revenue at a few BG sites. Only 24% of Bitcoin addresses on dark web BG sites have ever had money deposited on them. On the dark web, the top three clusters of crypto addresses account for 35% of the total revenue. On the clear web, the top three clusters account for 52% of the total revenue. The longer BG sites are online, the higher the revenue. There are hardly any warnings against BG sites. Conclusion Our results fit the Rational Choice model of crime: the revenue is modest, but the effort of the offenders is also limited.
As a novel decentralized computing paradigm, blockchain is expected to disrupt the existing e-commerce architecture and process. Secure smart contracts are the crucial foundation for e-commerce based on blockchain. However, vulnerabilities in smart contracts occur from time to time and cause significant financial losses in e-commerce. Some static verification methods have been developed to guarantee security for e-commerce smart contracts at design time, but they cannot support complex scenarios at runtime. As a lightweight verification method, runtime verification is a potential method for secure e-commerce smart contracts. The existing runtime verification methods are based on the manual instrument, which leads to additional overheads and gas consumption. To deal with this, we propose a passive learning-based runtime verification framework for e-commerce smart contracts. Firstly, by exploring the Genetic algorithm to evolve state merging and automaton reorganizing in order to simultaneously split time and gas behaviors, we propose a passive learning method to model runtime information for e-commerce smart contracts (PL4ESC). It directly learns P2TA (priced probabilistic timed automaton) from runtime traces without any prior knowledge. Then, we integrate PL4ESC with the open-source PAT (Process Analysis Toolkit) to automatically verify the security of runtime e-commerce smart contracts. The experiments show that PL4ESC is better at accuracy and precision than state-of-the-art passive learning methods. It improves accuracy by 1 to 4 percent compared to TAG and RTI+. As far as we know, it is not only the first learning method that can learn a P2TA from traces, but it is also the first automated runtime verification framework for e-commerce smart contracts. This will provide security guarantees for blockchain-based e-commerce.