The prosperity of Ethereum has led to a rise in phishing scams. Initially, scammers lured users into transferring or granting tokens to Externally Owned Accounts (EOAs). Now, they have shifted to deploying phishing contracts to deceive users. Specifically, scammers trick victims into either directly transferring tokens to phishing contracts or granting these contracts control over their tokens. Our research reveals that phishing contracts have resulted in significant financial losses for users. While several studies have explored cybercrime on Ethereum, to the best of our knowledge, the understanding of phishing contracts is still limited. In this paper, we present the first empirical study of phishing contracts on Ethereum. We first build a sample dataset including 790 reported phishing contracts, based on which we uncover the key features of phishing contracts. Then, we propose to collect phishing contracts by identifying suspicious functions from the bytecode and simulating transactions. With this method, we have built the first large-scale phishing contract dataset on Ethereum, comprising 37,654 phishing contracts deployed between December 29, 2022 and January 1, 2025. Based on the above dataset, we collect phishing transactions and then conduct the measurement from the perspectives of victim accounts, phishing contracts, and deployer accounts. Alarmingly, these phishing contracts have launched 211,319 phishing transactions, leading to 190.7 million in losses for 171,984 victim accounts. Moreover, we identify a large-scale phishing group deploying 85.7% of all phishing contracts, and it remains active at present. Our work aims to serve as a valuable reference in combating phishing contracts and protecting users' assets.
Sheng Zhang, Tan Kia Quang, Shen Wang, Shengchen Duan · 6 authors
Scam contracts on Ethereum have rapidly evolved alongside the rise of DeFi and NFT ecosystems, utilizing increasingly complex code obfuscation techniques to avoid early detection. This paper systematically investigates how obfuscation amplifies the financial risks of fraudulent contracts and undermines existing auditing tools. We propose a transfer-centric obfuscation taxonomy, distilling seven key features, and introduce ObfProbe, a framework that performs bytecode-level smart contract analysis to uncover obfuscation techniques and quantify obfuscation complexity via Z-score ranking. In a large-scale study of 1.03 million Ethereum contracts, we isolate over 3 000 highly obfuscated contracts and identify two scam archetypes, three high-risk contract categories, and MEV bots that employ a variety of obfuscation maneuvers such as inline assembly, dead code insertion, and deep function splitting. We further show that obfuscation substantially increases both the scale of financial damage and the time until detection. Finally, we evaluate SourceP, a state-of-the-art Ponzi detection tool, on obfuscated versus non-obfuscated samples and observe its accuracy drop from approximately 80 percent to approximately 12 percent in real-world scenarios. These findings highlight the urgent need for enhanced anti-obfuscation analysis techniques and broader community collaboration to stem the proliferation of scam contracts in the expanding DeFi ecosystem.
Abstract— This study integrates blockchain technology and machine learning to enhance credit card fraud detection. ​ Precise fraud prediction is performed using advanced algorithms such as Random Forest, Logistic Regression, XGBoost, and Bayesian models. ​ Tools such as Ganache and MetaMask from Ethereum blockchain facilitate safe and transparent tracking of suspicious transactions. ​ Decentralized and tamper-proof properties of blockchain add reliability, and machine learning adds precision and flexibility. The system is highly accurate and transparent and has the potential to be used to fight financial fraud. ​ Keywords— Credit Card Fraud, Blockchain, Machine Learning, Ethereum, Web3, SMOTE, XGBoost, Streamlit
Decentralized Finance (DeFi) has revolutionized financial transactions by enabling open, permissionless access to financial services. However, its lack of centralized oversight and pseudonymous architecture have also brought by fraudulent activities. This study presents a novel framework for fraud detection in DeFi that integrates graph neural networks (GNNs) with multi-agent reinforcement learning (MARL). Leveraging a directed transaction graph comprising 50,000 Ethereum addresses and over 120,000 token transfers, this paper evaluates four detection pipelines: extreme gradient-boosted decision trees (XGBoost), a GNN-only model (GCN), a standalone reinforcement learning agent (PPO), and a proposed GNN+RL hybrid model. The hybrid system combines graph-based embeddings with adversarial policy learning, where a fraudster and a detector co-evolve through a multi-agent PPO setup using PettingZoo’s ParallelEnv. Synthetic fraud strategies are generated using a GAN and projected into the GCN embedding space to simulate adaptive threats. Experimental results show that while GCNs outperform flat-feature models, the GNN+RL hybrid achieves superior balance across accuracy (84.58%), AUC (0.8176), and F1 score (0.7493), capturing both structural and behavioral fraud signals. Reward convergence curves further illustrate emergent adversarial dynamics. The proposed framework demonstrates the effectiveness of combining relational inductive biases, dynamic decision-making, and adversarial augmentation for resilient fraud detection. Future work includes extending to cross-chain analytics and enriching contextual understanding through integration with large language models.
Smart contract classification holds significant application value in the field of blockchain. However, existing methods suffer from inefficiencies and high computational complexity when dealing with smart contract data. To address these issues, this paper proposes a Cluster-BERT model based on neural clustering techniques. The model reduces the computational burden of self-attention mechanisms by clustering attention heads, thereby improving training efficiency. The Cluster-BERT model comprises multiple modules. Module 1 preprocesses smart contract data, converting abstract syntax trees and graph structure features into text representations suitable for BERT models. Module 2 serves as the core of the model, introducing neural clustering methods to reduce computational complexity. Module 3 further optimizes the model by finding the optimal number of centroids, achieving a balance between training efficiency and classification accuracy. Experimental results show that our proposed Cluster-BERT achieved an accuracy of 91.42%, a recall of 91.44%, and an F1 score of 91.43%, which indicates a noticeable improvement over the baseline model. Our model reduces computational complexity from quadratic to linear, resulting in an average reduction of 8.48% in training time and 7.88% in prediction time compared to the baseline model. On the smart contract dataset, the accuracy and precision of our model outperformed other models proposed in recent years by 1% to 2% points on average.
Minh Tri Le, O. M. Harris, Charlotte Bennett, Fiona Greene
With the deep penetration of blockchain technology across various fields, its security system faces severe challenges, and fraudulent activities are becoming increasingly frequent. This study focuses on the problem of fraud detection in blockchain and proposes an innovative model, FraudGNN, based on Graph Neural Networks (GNN). The model constructs a dynamic transaction graph, where transaction addresses are treated as nodes and asset transfer relationships as edges, incorporating time-series features. A Graph Attention Network (GAT) is used to extract behavioral features from node neighborhoods. In addition, a Bidirectional Long Short-Term Memory network (Bi-LSTM) is introduced to capture behavioral paths across block-level transactions, enabling accurate classification and prediction of abnormal accounts within blockchain networks. Experiments conducted on an Ethereum transaction dataset—containing approximately 3.6 million transaction records and 40,000 labeled addresses—show that the FraudGNN model significantly outperforms traditional methods such as Random Forest and Graph Convolutional Networks (GCN) in key metrics, achieving 91.2% precision, 87.5% recall, and an F1-score of 89.3%. In particular, the model demonstrates stronger generalization and reasoning capabilities when identifying previously unseen addresses, offering solid technical support for improving blockchain security systems.
In the rapidly evolving landscape of digital finance, the increasing sophistication of fraudulent activities has created significant challenges for traditional detection systems. This research paper investigates the integration of federated learning with unsupervised deep learning techniques to meet the dual demands of data privacy and robust fraud detection. Using two real-world datasets, the Credit Card Fraud dataset and the NeurIPS 2022 Bank Account Fraud dataset, we developed a federated framework based on deep autoencoders. The framework simulates decentralized model training across multiple financial nodes while ensuring that raw data remains local. The methodology includes detailed data pre-processing steps, the construction of a compact autoencoder architecture and a threshold-based approach to anomaly detection. Experimental outcomes demonstrate the model’s ability to distinguish between legitimate and fraudulent transactions by the use of performance evaluation through the use of Receiver Operating Characteristic (ROC) curves, confusion matrices, and reconstruction error distributions. Despite the challenges of class imbalance and data heterogeneity, the proposed model achieved promising results by maintaining competitive discrimination capabilities. Overall, the research study establishes the potential of federated learning combined with anomaly detection to provide scalability, privacy preservation, and interpretable fraud detection solutions suitable for real-world financial environments.
Hassen Louati, Ali Louati, Elham Kariri, Abdulla Almekhlafi
Blockchain technology has transformed modern digital ecosystems by enabling secure, transparent, and automated transactions through smart contracts. However, the increasing complexity of these contracts introduces significant challenges, including high computational costs, scalability limitations, and difficulties in detecting anomalous behavior. In this study, we propose an AI-based optimization framework that enhances the efficiency and security of blockchain smart contracts. The framework integrates Neural Architecture Search (NAS) to automatically design optimal Convolutional Neural Network (CNN) architectures tailored to blockchain data, enabling effective anomaly detection. To address the challenge of limited labeled data, transfer learning is employed to adapt pre-trained CNN models to smart contract patterns, improving model generalization and reducing training time. Furthermore, Model Compression techniques, including filter pruning and quantization, are applied to minimize the computational load, making the framework suitable for deployment in resource-constrained blockchain environments. Experimental results on Ethereum transaction datasets demonstrate that the proposed method achieves significant improvements in anomaly detection accuracy and computational efficiency compared to conventional approaches, offering a practical and scalable solution for smart contract monitoring and optimization.
Phishing detection on Ethereum has increasingly leveraged advanced machine learning techniques to identify fraudulent transactions. However, limited attention has been given to understanding the effectiveness of feature selection strategies and the role of graph-based models in enhancing detection accuracy. In this paper, we systematically examine these issues by analyzing and contrasting explicit transactional features and implicit graph-based features, both experimentally and analytically. We explore how different feature sets impact the performance of phishing detection models, particularly in the context of Ethereum's transactional network. Additionally, we address key challenges such as class imbalance and dataset composition and their influence on the robustness and precision of detection methods. Our findings demonstrate the advantages and limitations of each feature type, while also providing a clearer understanding of how feature affect model resilience and generalization in adversarial environments.
Sinan Durgut, Ecir Uğur Küçüksille, Mahmut Tokmak
The increasing adoption of blockchain technology has presented significant challenges in maintaining the security and reliability of smart contracts. This study addresses the problem of identifying security flaws in smart contracts, which may result in monetary damages and diminished confidence in blockchain systems. A Hybrid Quantum–Classical Deep Neural Network (HQCDNN) approach was proposed, combining quantum computing principles with classical deep learning methods to identify various vulnerability types, including access control, arithmetic, front-running, reentrancy, time manipulation, denial of service, and unchecked low calls. The SmartBugs Wild Dataset was used for training, with TF-IDF employed as a preprocessing technique optimized for hybrid architectures. Experiments were conducted using hybrid architectures with 2-qubit and 4-qubit quantum layers, alongside a classical deep neural network (DNN) model for comparative analysis. The HQCDNN model attained accuracy levels ranging from 96.4% to 78.2% and F1-scores between 96.6% and 80.2%, showcasing enhanced performance compared to the classical and deep learning models referenced in the literature. These results highlight the capability of HQCDNNs to improve the identification of security flaws in smart contracts. Future work could focus on evaluating the model on actual quantum devices and expanding its application to larger datasets for further validation.
Blockchain technology is revolutionizing various industries through decentralized architecture and secure transaction mechanisms, yet its core application—smart contracts—faces increasingly sophisticated security threats. Recognizing the critical need for enhanced protection in this emerging domain, this paper introduces TPH-Fuzz, a two-phase hybrid fuzzing framework designed to overcome current limitations in vulnerability detection. TPH-Fuzz combines global exploration with local vulnerability targeting. It utilizes dynamic symbolic execution for semantics-aware path analysis and employs data-dependency-based state modeling to generate effective transaction sequences. These methods improve both path exploration and vulnerability detection precision significantly. Experiments on a coverage dataset of 9309 contracts demonstrate an 85% branch coverage on complex contracts, outperforming conventional methods; meanwhile, tests on a vulnerability dataset of 1086 labeled contracts show a detection precision of 89.24% across eight vulnerability categories. The promising results underscore the framework’s potential to transform security auditing practices in the blockchain industry, paving the way for more reliable smart contract development and deployment.
Junhao Wu, Yixin Yang, Chengxiang Jin, Silu Mu · 8 authors
With the widespread adoption of Ethereum, financial frauds such as Ponzi schemes have become increasingly rampant in the blockchain ecosystem, posing significant threats to the security of account assets. Existing Ethereum fraud detection methods typically model account transactions as graphs, but this approach primarily focuses on binary transactional relationships between accounts, failing to adequately capture the complex multi-party interaction patterns inherent in Ethereum. To address this, we propose a hypergraph modeling method for the Ponzi scheme detection method in Ethereum, called HyperDet. Specifically, we treat transaction hashes as hyperedges that connect all the relevant accounts involved in a transaction. Additionally, we design a two-step hypergraph sampling strategy to significantly reduce computational complexity. Furthermore, we introduce a dual-channel detection module, including the hypergraph detection channel and the hyper-homo graph detection channel, to be compatible with existing detection methods. Experimental results show that, compared to traditional homogeneous graph-based methods, the hyper-homo graph detection channel achieves significant performance improvements, demonstrating the superiority of hypergraph in Ponzi scheme detection. This research offers innovations for modeling complex relationships in blockchain data.
Abstract Forecasting cryptocurrencies as a financial issue is crucial as it provides investors with possible financial benefits. A slight improvement in forecasting performance can lead to increased profitability; Therefore, obtaining a realistic forecast is very important for investors. Bitcoin, frequently mentioned in recent due to its volatility and chaotic behavior, has become an investment tool, especially during and after the COVID-19 pandemic. In this study, selected ML techniques were investigated for predicting cryptocurrency movements by using technical indicator-based data sets and measuring the applicability of the techniques to cryptocurrencies that do not have sufficient historical data. In order to measure the effect of data size, Bitcoin’s last 1 year and 7 years of data were used. Following the related literature, Google trends and the number of tweets were used as input features, in addition to the most commonly used twelve technical indicators. Random Forest, K-Nearest Neighbors, Extreme Gradient Boosting (XGBoost-XGB), Support Vector Machine (SVM), Naive Bayes (NB), Artificial Neural Networks (ANN), and Long-Short-Term Memory (LSTM) network were optimized for best results. Accuracy, F1, and area under the ROC curve values were used to compare the model performance. For continuous data, ANN and SVM performed the best with the highest accuracy and outperformed the other ML models for complete and reduced sets. LSTM reached the best accuracy for trend data, but SVM, NB, and XGB models showed similar performance. The research shows that some indicators significantly affect prediction performance, and the data discretization process also improved the model’s accuracy. While the number of samples affects the results of many ML models, correctly optimized and fine-tuned models may also give excellent results even with less data.
The increasing adoption of blockchain technology has led to a surge in financial fraud, including money laundering, Ponzi schemes, and illicit fund transfers. Traditional fraud detection techniques, such as rule-based systems and supervised machine learning models, struggle to handle the high-volume, high-velocity, and dynamically evolving nature of blockchain transactions. These limitations necessitate a scalable and adaptive approach to detect fraudulent activities efficiently. This study introduces a Spatial-Temporal Graph Neural Network (STGNN)-based fraud detection framework, specifically designed for scalable anomaly detection in large-scale blockchain networks. By modeling blockchain transactions as a spatial-temporal graph, the proposed system captures structural dependencies between wallets and temporal patterns of fund movements. The STGNN model employs graph convolutional networks (GCN) or graph attention networks (GAT) for spatial feature extraction and gated recurrent units (GRU) or temporal convolutional networks (TCN) for sequential fraud pattern recognition. Additionally, to ensure scalability, the framework incorporates graph partitioning techniques, parallelized mini-batch training, and distributed processing, enabling real-time fraud detection across high-throughput blockchain networks. Extensive experiments conducted on Bitcoin and Ethereum transaction datasets demonstrate that the STGNN model achieves higher accuracy, lower false positive rates, and improved computational efficiency compared to rule-based fraud detection systems, supervised ML models, and static GNNs. Case studies further confirm the model’s effectiveness in detecting large-scale fraud schemes, such as DeFi exploits, cross-chain laundering, and coordinated illicit transactions. This research highlights the potential of graph-based deep learning techniques in blockchain security, providing a foundation for future advancements in scalable fraud detection, cross-chain anomaly detection, and decentralized financial security monitoring.
Ben Berger, Edward W. Felten, Akaki Mamageishvili, Benny Sudakov
Optimistic rollups rely on fraud proofs -- interactive protocols executed on Ethereum to resolve conflicting claims about the rollup's state -- to scale Ethereum securely. To mitigate against potential censorship of protocol moves, fraud proofs grant participants a significant time window, known as the challenge period, to ensure their moves are processed on chain. Major optimistic rollups today set this period at roughly one week, mainly to guard against strong censorship that undermines Ethereum's own crypto-economic security. However, other forms of censorship are possible, and their implication on optimistic rollup security is not well understood. This paper considers economic censorship attacks, where an attacker censors the defender's transactions by bribing block proposers. At each step, the attacker can either censor the defender -- depleting the defender's time allowance at the cost of the bribe -- or allow the current transaction through while conserving funds for future censorship. We analyze three game theoretic models of these dynamics and determine the challenge period length required to ensure the defender's success, as a function of the number of required protocol moves and the players' available budgets.
The advent of decentralised applications across a range of sectors has led to a growing emphasis on the research and development of methods to identify vulnerabilities in smart contracts for decentralised applications. However, current detection techniques have been found to have limitations in terms of accuracy and the number of false alarms they generate. In order to address the aforementioned issues, this paper puts forth a modular vulnerability detection model, designated as BAMC. The method initially utilises the word2vec model to derive the word vector representation of the smart contract, subsequently extracting the word order information through a bidirectional long short-term memory network. Subsequently, the attention mechanism and max-pooling operation are employed to process the word order information, thereby obtaining fine-grained features and key features. Ultimately, explicit bounded-degree feature interactions are achieved through the combination of deep and cross networks, thus enabling the detection of reentrancy vulnerabilities and timestamp vulnerabilities. The experimental results demonstrate that the proposed method exhibits superior performance in comparison to existing techniques, with significantly higher values for various indexes. Notably, the reentrancy vulnerability and the - of timestamp vulnerability reach 86.14 and 91.43 , respectively.
Regina Cibelle de Oliveira, Edson Mello Lucas, Gustavo Barbosa Libotte
Smart Contracts are autonomous, self-executable programs that facilitate agreement execution without the need for intermediaries. These contracts are also susceptible to software defects, leading to vulnerabilities that can be exploited by attackers. The use of models for predicting software defects is a well-studied research area. However, applying these models with Smart Contract metrics is an area that remains underexplored. The aim of this study is to evaluate whether deep learning models used in the prediction of traditional software defects produce equivalent results with specific Smart Contract metrics. Machine learning models were applied to four data sets, and performances were evaluated using Precision, Recall, F-score, Area under the curve (AUC), Precision-recall curve (PRC), and Matthews Correlation Coefficient (MCC). This approach complements traditional formal verification methods, which, although accurate, are often slower and less adaptable to emerging vulnerabilities. By employing deep learning, the model enables faster and more cost-effective analysis of large volumes of Smart Contracts. Unlike conventional techniques that rely on expert-defined rules and require substantial computational resources, this model offers scalable and continuous monitoring. Consequently, the research provides a complementary solution that can significantly enhance the security of the smart contract ecosystem, allowing for the detection of potential defects before exploitation occurs.
Smart contracts, closely intertwined with cryptocurrency transactions, have sparked widespread concerns about considerable financial losses of security issues. To counteract this, a variety of tools have been developed to identify vulnerability in smart contract. However, they fail to overcome two challenges at the same time when faced with smart contract bytecode: (i) strong interference caused by enormous non-relevant instructions; (ii) missing semantics of bytecode due to incomplete data and control flow dependencies. In this paper, we propose a multi-teacher based bytecode vulnerability detection method, namely Multi-Teacher Vulnerability Hunter (MTVHunter), which delivers effective denoising and missing semantic to bytecode under multi-teacher guidance. Specifically, we first propose an instruction denoising teacher to eliminate noise interference by abstract vulnerability pattern and further reflect in contract embeddings. Secondly, we design a novel semantic complementary teacher with neuron distillation, which effectively extracts necessary semantic from source code to replenish the bytecode. Particularly, the proposed neuron distillation accelerate this semantic filling by turning the knowledge transition into a regression task. We conduct experiments on 229,178 real-world smart contracts that concerns four types of common vulnerabilities. Extensive experiments show MTVHunter achieves significantly performance gains over state-of-the-art approaches.
The Ethereum blockchain operates as a decentralized platform, utilizing blockchain technology to distribute smart contracts across a global network. It enables currency and digital value exchange without centralized control. However, the exponential growth of online commerce has created a fertile ground for a surge in fraudulent activities such as money laundering and phishing, thereby exacerbating significant security vulnerabilities. To combat this, our article introduces an ensemble learning approach to accurately detect fraudulent Ethereum blockchain transactions. Our goal is to integrate a decision-making tool into the decentralized validation process of Ethereum, allowing blockchain miners to identify and flag fraudulent transactions. Additionally, our system can assist governmental organizations in overseeing the blockchain network and identifying fraudulent activities. Our framework incorporates various data pre-processing techniques and evaluates multiple machine learning algorithms, including logistic regression, Isolation Forest, support vector machine, Random Forest, XGBoost, and recurrent neural network. These models are fine-tuned using grid search to enhance their performance. The proposed approach utilizes an ensemble of three distinct models (Random Forest, extreme gradient boosting (XGBoost), and support vector machine) to further improve classification performance. It achieves high scores of over 98% across key classification metrics like accuracy, precision, recall, and F1-score. Moreover, the approach is suitable for real-world usage, with an inference time of 0.13 s.
Smart contracts are at the core of blockchain technology, but the cost of fixing their security vulnerabilities is high, making pre-deployment vulnerability detection crucial. Existing methods rely on fixed rules, which have limitations in accuracy and scalability, and their efficiency decreases with the complexity of the rules. Neural-network-based methods can identify some vulnerabilities but are inefficient in multi-vulnerability scenarios and depend on source code. To address these issues, we propose a multi-vulnerability-based smart contract detection method called RTMS. RTMS takes bytecode as input, disassembles it into opcodes, uses the gas consumed by the contract for data slicing, and extends the length of input opcodes through a layered structure. It employs a weighted binary cross-entropy (BCE) function to handle data imbalance and combines channel-sequence attention mechanisms to extract vulnerability correlation features. By using transfer learning, it reduces training parameters and computational costs. Our RTMS model can detect multiple vulnerabilities simultaneously, enhancing detection accuracy and efficiency. In experiments with 100,000 real contract samples, the model achieved a Jaccard coefficient of 0.9312, a Hamming loss of 0.0211, and an F1 score that improved by about 11 percentage points compared to existing models, demonstrating its superiority and stability.
Blockchain innovation, best embodied by Ethereum, has revolutionized online transactions by making them more transparent and secure. However, the demand for more sophisticated fraudulent schemes increases with wider adoption, calling for more sophisticated fraud detection methods. Therefore, this paper contributes to the area of blockchain security by providing insights to regulators and stakeholders in Ethereum through an analysis of the Machine Learning (ML) models. We compare traditional approaches like logistic regression and decision trees with more advanced techniques like neural networks and ensemble methods. The performance of the model is measured using accuracy, precision, recall, and the ROC curve. The best accuracy of 0.98 is achieved by the optimized XGBoost framework.
A newly proposed hybrid approach that makes use of both supervised and unsu pervised machine learning to implement security within blockchain transactions. Blockchain, despite its central role in the decentralized networks and the crypto graphic cryptography, is still open to high-end attacks. Making use of random forest, autoencoders, and SVM models to tap their strengths on classification and anomaly detection fights these threats. Normalization and feature selection tech niques boost the performance of a model. Thus, the hybrid model demonstrated above surpassing the performance of standalone models in fraud detection and mitigation indicates that this will be a future-proof solution fortified upon emerg ing threats behind secure digital finance in blockchain.
Cryptocurrency has transformed finance and investment, with platforms like Uniswap facilitating billions of dollars in trades. However, malicious smart contracts and scam tokens have led to significant financial losses for decentralized finance (DeFi) users. Code analysis alone cannot detect rug pulls using social engineering tactics. To address this issue, machine learning algorithms can leverage the vast amount of transactional data stored on the blockchain, particularly time series data, to identify scam tokens. This study aims to determine the optimal timeframe for detecting rug pulls and highlights the importance of token volume and transaction count features. The findings suggest that shorter timeframes are sufficient for detecting rug pull tokens since most incidents occur soon after token creation. This research offers new insights into scam token classification and prevention and contributes to a broader understanding of this field. • Rug pull detection in Uniswap V3 is researched via on-chain indicators over time. • Many rug pulls occur during the first day after token creation. • Time windows close to rug pull events significantly influence the model's predictions.