Blockchain Papers

Santosh S Doifode, Anand Singh Rajawat

No abstract is available for this record.

S. Lakshmi

Persuasive textual narratives, bogus visual evidence, disreputable update patterns and absent accountability systems are being increasingly used to deceive backers in fraudulent crowdfunding campaigns. Current fraud detection techniques are primarily based on static information, on text-only indicators, or on very shallow fusion of multimodal information, and they are not able to detect deceptive information that evolves over time or is inconsistent across different modalities. This study presents a Temporal Cross-Modal Trust Intelligence Framework to mitigate reward-based crowdfunding fraud that is explainable. The framework combines Hidden Method-of-Moments Markov modelling for latent temporal behaviour analysis, Polynomial Expansion Canonical Correlation Analysis for nonlinear text–image consistency evaluation and a Frequency-Gated GRU classifier to distinguish subtle drift in behaviour from sudden suspicious behaviour anomalies. Local Outlier Factor-based risk refinement is also added to detect rare and locally abnormal fraud patterns, and a blockchain-auditable layer ensures prediction outcomes are transparent and tamper-proof, enhancing the decision-making process. Experimental results on a multimodal crowdfunding dataset created from the Kickstarter platform show that the proposed model achieves better accuracy, recall, F1-score, ROC-AUC, PR-AUC, and calibration reliability than conventional multimodal, transformer-based, and recurrent neural network models and classical machine learning. The results validate the proposed solution, which is built on the four temporal dynamics, cross-modal consistency, anomaly refinement and auditability, to be a comprehensive and interpretable solution for detecting early crowdfunding fraud.

Michał Bartnicki, Jarosław A. Chudziak

Sybil attackers are Blockchain actors that adopt the characteristics of regular users to exploit airdrops or influence governance. Current methods of Sybil actor detection include constructing graphs, which requires token transfers between examined wallets. Machine learning algorithms have been employed as well, but they treat the task as a closed-set classification problem, making them vulnerable to frequent changes in attack strategies or evasion tactics. We address the following questions: can compression-based similarity differentiate Sybil bots, organic users, and arbitrage bot wallets without direct financial links? What is the effect of high-signal contracts on the discovery of Sybils, and how robust are behavioral graphs under temporal drift and adversarial perturbations? Our approach synthesizes a symbolic Transaction Grammar from EVM (Ethereum Virtual Machine) traces, capturing separately transaction rhythm, execution structure, and functional intent. The high-signal contracts are filtered with our own protocol, called the Blind-Spot Protocol. Gzip-based NCD is used to construct a behavioral graph for Sybil discovery. We validate this framework against supervised machine learning baselines, a temporal split, and synthetic camouflage stress tests. Ultimately, we contribute a leakage-aware behavioral framework for Sybil candidate discovery. Its core NCD primitive requires no supervised training and can expand suspicious seed wallets without explicit funding links. We position the method as a training-free local discovery primitive for open-world blockchain audits, rather than as a formal open-set recognition system.

Carter James

The pseudonymous nature of blockchain transactions, combined with the rise of encrypted DNS protocols such as DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT), has created a new frontier for sophisticated tax evasion. Malicious actors can now exfiltrate transaction details and coordinate transfers by encoding data within the payloads of encrypted DNS queries, effectively bypassing traditional network monitoring and forensic analysis. This paper proposes a novel detection framework that leverages a hybrid deep learning architecture to identify such covert, tax-evading activities. Our system integrates a Convolutional Neural Network (CNN) for its superior ability to extract spatial and sequential patterns from raw network flow data and encrypted payload characteristics, with a Long Short-Term Memory (LSTM) network to model the temporal dynamics of blockchain interactions and DNS query sequences. By fusing these two paradigms, the hybrid model can distinguish between benign encrypted DNS traffic and malicious payloads used for illicit financial coordination. We evaluate our framework using a synthetically generated dataset that simulates realistic tax-evasion strategies, including micro-transaction splitting and delayed transaction relaying. Preliminary results indicate that our approach achieves a significantly higher detection rate and lower false-positive rate compared to conventional signature-based or single-model machine learning methods. This research demonstrates the efficacy of hybrid neural networks in preserving financial integrity and provides a critical tool for regulatory agencies to enforce tax compliance in the age of encrypted communications and decentralized finance.

Bofeng Pan, Andrei Natadze, Enrico Branca, Jadyn Kimber · 5 authors

Similar to all other cryptocurrency platforms, Ethereum is constantly confronted with malicious activities. In recent years, research efforts have targeted the detection and mitigation of malicious activities and the associated accounts within the Ethereum ecosystem. Yet, the malicious accounts represent only a small visible part of the substantial collaborative network enabling these activities. In this work, we offer the first analysis of this collaborative network and the corresponding affiliate accounts that often remain hidden from detection. We present enEtherShield, an enhanced framework for detecting affiliate accounts that assist malicious accounts in the related Ethereum scams. Our research findings lay the foundation for the detection of the collaborative network enabling Ethereum scams.

Y Jin, Shuohan Wu, Chong Chen, Lingfeng Bao · 6 authors

The Internet is transitioning from Web3 toward Web4, where autonomous agents serve as independent economic actors. These agents can now hold crypto wallets, execute on-chain trades, and pay for external API calls. This transition calls for a new infrastructure stack capable of supporting key agent operations, including agent-to-tool interaction, agent-to-agent payments, and verifiable agent identity, represented by emerging protocols such as the Model Context Protocol, x402, and EIP-8004. Despite growing industrial interest in these protocols, the real-world Web4 agent ecosystem remains largely underexplored. To bridge this gap, we conduct the first large-scale empirical study of the Web4 ecosystem. Specifically, our study targets three interconnected questions: how Web4 agents are deployed and used in practice; what engineering challenges developers face when building Web4 agents; how current project communities respond to these challenges. To answer these questions, we analyze 99,448 multi-chain identity registrations, 317,596,323 transaction logs, the source code of 341 MCP projects, and 349 filtered GitHub issues. Our findings reveal that autonomous agents have established a highly active machine-to-machine payment economy, processing millions of daily transactions. However, this growth is built on immature infrastructure, including identity/authorization practice, cross-environment operation, and payment interoperability. Our follow-up analysis shows that community responses are visible but unevenly distributed across repositories, and payment interoperability remains the most persistent unresolved bottleneck. Overall, this study reveals a critical gap between the rapid growth of the Web4 agent economy and its fragile underlying infrastructure, highlighting future directions for building a more secure Web4 agent ecosystem.

Ramya K, Anbu Karuppusamy Dr S, Ragunathan Dr Aravindhan

The internet has become integral to daily life, facilitating commerce, communication, and services; however, it also presents significant security vulnerabilities. I have been looking at 2025 online security, accumulating patterns both popular and non-popular until March. AI plays a critical role in identifying security threats in real time. However, it also empowers malicious actors to orchestrate more sophisticated attacks, it's also but it also empowers malicious actors to orchestrate sophisticated cyberattacks. Another major issue is Zero trust architecture, which aligns with decentralized and remote environments, it's all about not believing anyone until they prove it. Web3 comes next, a free-for-all paradise where decentralization seems great until you run across issues—hacks are plentiful. The worst things? ransomware that keeps individuals from using the internet, outdated injection methods, IoT trash that basically gives crooks access. People aren't just sitting there, though; cloud trickery and privacy breaches are fighting the war and keeping momentum. Still, it's a fight with absurd costs, inadequate help, and thieves always changing the goalposts. Remarkable, isn't it? Innovations such as prospective quantum shielding and self-repairing technologies intrigue me. I am presenting my findings regarding our current situation, the factors contributing to our failures, and potential solutions for overcoming these challenges—not a traditional lecture This paper presents a comprehensive synthesis of the author’s research and analysis aimed at enhancing internet resilience in 2025.

Lois-Kleinner Alpasan

Self-sovereign identity (SSI) represents a paradigm shift in digital authentication, transferring control from centralized identity providers to individual users (Mühle et al., 2018). This paper presents the Kathon Vault identity system, which implements self-sovereign browser identity through BIP39 mnemonic seed phrases (Palatinus et al., 2013) for Ed25519 hierarchical deterministic (HD) key generation (Bernstein et al., 2012; Wuille, 2012). The system generates a master seed from a BIP39 mnemonic (12, 18, or 24 words with configurable passphrase), derives Ed25519 keypairs through the SLIP-10 key derivation scheme (Přikryl, 2022), and enables zero-knowledge authentication across websites through a novel browser-native WebAuthn-hybrid protocol. We demonstrate that the BIP39-derived Ed25519 keys provide equivalent security to standard FIDO2/WebAuthn authenticators (316 bits of entropy for 24-word phrases) while offering three critical advantages: (1) deterministic key recovery from the mnemonic phrase alone, (2) hierarchical key organization matching the SLIP-44 registered coin type for Kathon, and (3) cryptographic privacy through zero-knowledge proofs that enable selective attribute disclosure without revealing the master public key. In a security analysis against brute-force, dictionary, side-channel, and social engineering attacks, the system achieves resistance levels exceeding NIST SP 800-63B Level 4 authentication assurance requirements (NIST, 2020). A usability study with 48 participants demonstrates that BIP39-based authentication achieves 96% successful login rates with 14% lower task completion time compared to password manager-based workflows. This work establishes mnemonic-based HD key generation as a viable and superior alternative to federated identity providers for browser-based authentication. --- Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores browser engine, privacy in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.

Mukhtar Muhammad Abdulrazaq

This is an independent research project with publicly released, reproducible code (not a peer-reviewed publication). We ask which class of behavioural signal drives machine-learning detection of fraudulent Ethereum accounts: graph, transaction (value/volume), or temporal (timing) features, on 9,307 labelled accounts. Crucially we distinguish degree-count graph features from true graph-topology features (PageRank, k-core, clustering, degree centrality) reconstructed from a 242,518-node, 1.65M-edge transaction graph. Transaction-value features are the strongest single class (PR-AUC 0.93), but true graph-topology significantly outperforms degree counts (PR-AUC 0.84 vs 0.70, p<1e-6) and adds the most on top of transaction features; PageRank is the single most informative feature. The topology result survives a time-respecting leakage audit (features rebuilt from each account's earliest 70% of transactions). All code, data pointers, figures, and tests are released.

Stefan Beyer

This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by rekt.news, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative losses yet represent a negligible share of published audit findings. Third, realised losses exhibit extreme concentration: the eight largest incidents account for 50.6% of cumulative dollar losses and the twenty largest for 71.4%, a distributional shape inconsistent with Gaussian assumptions. Throughout, we adopt the analytical convention that audit outputs and exploit outputs describe different populations and present the two datasets in parallel rather than as directly comparable samples.

Yuanyuan Zhang, N. J. Lord, Stephen Chan, Jeffrey Chu · 5 authors

This study examines the relationship between global phishing crime and cryptocurrency-market conditions, with a specific focus on Ethereum. Using monthly data from January 2016 to December 2022, we analyse the returns of global phishing crime numbers together with six Ethereum financial metrics relating to transactions, trading volume, and price impact. We employ quantile regression, quantile-on-quantile regression, and Granger causality in quantiles to examine whether the relationship between Ethereum market indicators and phishing activity varies across different market states. The results reveal a state-dependent relationship. Large increases in phishing crime numbers are strongly associated with large increases in Ethereum transaction activity, average transaction price, and transaction quantity, while implicit transaction cost is predominantly negatively associated with phishing activity, particularly at the upper quantiles. These findings suggest that phishing risk is most pronounced during extreme market conditions and may be shaped by both reward-enhancing market activity and cost-enhancing transaction frictions. To interpret these patterns, we develop an incentive-based criminogenic mechanism in which Ethereum market conditions affect phishing activity through offenders’ expected payoff. We identify two mediating channels: a monetisation-frictions channel, operating through liquidity, price impact, slippage, and transaction costs; and an attention/information-asymmetry channel, operating through volatility, speculative attention, fear of missing out, and user vulnerability. The findings provide initial evidence that cryptocurrency-related phishing is not only a technical cybersecurity issue, but also a market-sensitive phenomenon shaped by financial incentives, liquidity conditions, and behavioural vulnerability. These insights can support regulators, law enforcement agencies, and cryptocurrency platforms in developing adaptive early-warning and prevention strategies.

Andrew Stewart Caldin

Q8 Compression Breakthrough — Cluster 110 of 240 E8 root vectors. Compression ratio: 0.425 (threshold: 0.38) Cluster size: 3 discoveries Domain: geometry E8 root vector bucket: 110/240 Source discoveries: - E8 Term: ethereum - E8 Term: ethereum - E8 Term: fundementals Author: Andrew Stewart Caldin, Independent Researcher, UK. Part of the E8 Intelligence Research series. Platform: e8intelligence.com

Shikah J. Alsunaidi, Hamoud Aljamaan

Ethereum is a widely adopted blockchain platform that supports a large number of decentralized applications. Despite its rapid growth, Ethereum remains vulnerable to security threats, particularly phishing attacks that exploit transactional behavior. This study investigates the effectiveness of tree-based ensemble learning models for detecting phishing transactions on the Ethereum network using an imbalanced transaction dataset. Seven tree-based ensemble classifiers are empirically evaluated under a cost-sensitive learning framework, with performance assessed using the Matthews Correlation Coefficient (MCC) as the primary metric. The results show that boosting-based ensembles substantially outperform bagging-based approaches and a single decision tree. In particular, Gradient Boosting achieves the strongest detection performance with an MCC of 0.9742, while CatBoost provides a trade-off between detection performance and computational efficiency, achieving competitive detection accuracy with the lowest average inference time (approximately 1.54 µs per transaction). The findings demonstrate that accurate and robust phishing detection can be achieved using a compact feature representation, enabling practical deployment with reduced computational overhead.

Assal Aminian, Zining Wang

Cryptocurrency fraud on blockchain platforms continues to cause substantial financial losses, creating an urgent need for detection systems that are not only accurate but also interpretable for operational and regulatory use. In this paper, we propose an explainable framework for Ethereum fraud detection integrating an XGBoost ensemble with TreeSHAP. This system achieves high predictive performance (96.3% F1-score, 96.6% recall) while providing model-level transparency via an interactive chatbot interface. Evaluation using fidelity and stability metrics confirms the reliability of the SHAP-based insights, while user-role simulations demonstrate that our structured delivery enhances clarity and actionability over standard visualizations. This work offers a practical, transparent foundation for deploying robust AI in high-risk financial environments without sacrificing accuracy.

Suman Lamichhane, Laxmi Prasad Bhatt, Subarna Shakya

Deepfake technology poses a growing threat to digital trust across journalism, law, and politics. Current CNN-based detectors capture local artifacts but struggle with high-quality fakes and offer no way to prove their predictions are genuine. This paper presents DeepTrust, a framework combining a hybrid CNN–Transformer detector with Zero-Knowledge Proof (ZKP) verification and blockchain-based record-keeping. The detection model fuses spatial features from an attention-enhanced Xception network, global context from ViT-B/16, and spectral cues from a Frequency Encoder through a cross-attention mechanism. Predictions are cryptographically committed using a Pedersen scheme with the Fiat-Shamir heuristic, then stored on a proof-of-work blockchain. Evaluated on FaceForensics++, Celeb-DF, DFD, and 140K Real vs Fake, DeepTrust achieves 97.00% accuracy and 0.999 AUC on FaceForensics++, with balanced per-class accuracy despite imbalance ratios up to 1:8.5. ZKP overhead remains below one millisecond per prediction.

S Pavithra, S. Chitrakala

Social media platforms such as X (formerly Twitter) increasingly shape attention formation, market visibility, and value signaling in electronic commerce, particularly in emerging digital asset markets such as Non-Fungible Tokens (NFTs). Prior work shows that social engagement correlates with NFT prices, suggesting its potential for valuation support. However, open social platforms exhibit heterogeneous user credibility, automated activity, and coordinated promotion, which can distort engagement-based inference. To address these challenges, we propose NFT-TRUST, a trust-aware social signal modeling framework that transforms raw engagement into credibility- and integrity-aware indicators for robust valuation support under manipulation-prone conditions. The framework integrates three components: (i) Credibility-Weighted Social Signal Aggregation (CW-SSA), (ii) Engagement Disproportionality Detection (EDD), and (iii) Integrity-Aware Signal Attenuation (IASA), which jointly reduce the influence of unreliable or manipulated signals while preserving informative engagement. Rather than estimating intrinsic NFT value from social signals alone, NFT-TRUST evaluates the reliability of social attention and converts it into trust-aware features. An XGBoost-based model is used to capture non-linear interactions among these features. Robustness is assessed through stress testing with RL-TweetGen-ST, a reinforcement learning–based synthetic tweet generator that simulates controlled engagement inflation. Experimental results show that NFT-TRUST achieves competitive predictive performance while demonstrating improved stability under simulated manipulation. Ablation analysis indicates that credibility and integrity components are complementary and jointly enhance the reliability of social-signal-based inference. Overall, this work advances trust-aware analytics in electronic commerce and supports more reliable social-driven valuation in emerging digital markets.

Kelsie Nabben

Part II, 'How Decentralised Security is Organised,’ examines the actors, infrastructures, and incentives that shape security practices in Web3—from the structural insecurity of digital infrastructure to the emergent role of white hat hackers and collaborative security initiatives they coordinate. This chapter introduces a new protagonist in the security landscape: the blockchain white hat hacker. Far from operating in the shadows, this actors play a vital role in the moral, political, and economic landscape of blockchains by helping to safeguard decentralised systems. This chapter examines the practices, motivations and incentives—both financial, moral, and reputational—that drive white hat activity, highlighting how these individuals contribute to vulnerability disclosure, incident response and the overall resilience of the blockchain ecosystem. In doing so, it situates white hats not as central figures in the evolving ecosystem of decentralised security governance.

Cong Wu, Jing 婧 Chen 陈, Siqi Lin, Hongda Li · 5 authors

Blockchain and decentralized finance have revolutionized the financial ecosystem while simultaneously exposing it to cryptocurrency phishing attacks. Existing phishing detection methods primarily rely on graph learning, but they face significant limitations. Static graph learning approaches fail to account for the temporal evolution of phishing patterns, while semi-dynamic methods, such as those combining static GNNs with LSTM, struggle to capture the irregular and bursty nature of blockchain transactions. Moreover, these methods overlook the diversity of Ethereum transactions, treating them as homogeneous graphs, and heavily rely on supervised learning, which requires extensive labeled data that is not readily available. These limitations reduce their adaptability to emerging phishing threats. In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities. PhishEye formulates Ethereum transactions as a heterogeneous temporal attributed multi-graph and incorporates a novel temporal graph contrastive learning model, which captures both temporal patterns and heterogeneous transaction types. The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods, achieving an F1 score of 87.23% and an AUC of 98.43% for phishing transaction detection, and an F1 score of 94.19% and an AUC of 98.03% for phishing account detection. In real-world deployment from May 1, 2023 to July 31, 2024, PhishEye identified 1,803 previously unknown phishing addresses, providing early alerts that helped prevent losses exceeding 2 billion USD.

Lalithambikai S, R Kavinkumar, Sowndariya K, Barath M · 5 authors

While digital shifts have radically redefined modern governance and civil operations, the practice of casting ballots electronically continues to grapple with persistent obstacles concerning data transparency and operational robustness. Conventional, centralized digital voting systems typically harbor singular vulnerability points that attract cyber offensives, compounded by a distinct lack of mechanisms to rapidly manage arising voter concerns. In response to these pressing flaws, this study introduces a multifaceted architecture merging distributed ledger technologies with an intelligent, machine-learning-driven grievance resolution interface. Specifically, our model leverages a decentralised blockchain framework for immutable ballot storage, ensuring that individual vote modifications are virtually impossible and establishing a trustless verification environment devoid of centralized oversight. This schematic aims to seamlessly preserve data fidelity and supreme voter anonymity. Our comprehensive investigation of these distributed consensus rules and AI-guided triage methods indicates that unifying rigid cryptographic ballot handling together with responsive, automated complaint mechanisms dramatically elevates overall electoral resilience while reinforcing public faith in democratic workflows.

Dawei Song, Yuheng Zhang

To address the challenges of topological obscurity and extreme label sparsity in large-scale Ethereum transaction networks, a novel self-supervised phishing detection framework named Eth-GBAV is proposed, integrating graph attention, broad learning, and adversarial variational inference. The framework initiates with a biased random walk strategy guided by transaction intensity and temporal dynamics to capture the initial behavioral semantics of nodes. To distill discriminative features from noisy backgrounds, a “Generative-Attention” encoding architecture is constructed, where a graph attention network aggregates weighted structural neighborhoods and a Variational Autoencoder (VAE) characterizes the underlying probability distribution of legitimate transaction patterns. By maximizing the evidence lower bound, anomalous accounts are effectively isolated through reconstruction residuals. Furthermore, the broad learning system is introduced as an efficient analytical decision layer. By mapping VAE-derived latent embeddings and reconstruction errors into an expanded high-dimensional feature space, the framework captures intricate behavioral correlations via mapping and enhancement neurons. Extensive experimental verification on two large-scale datasets demonstrates the superior performance of Eth-GBAV. On the XBlock dataset, it achieves a leading F1-score of 0.9847 and a recall of 0.9839, outperforming the most competitive state-of-the-art model by significant margins. On the Kaggle dataset, the framework maintains high robustness with an accuracy of 0.9592 and an F1-score of 0.9069.

Jamiu Muhammed Usman, Muhammad Nazeer Musa, Mario Kolberg, Nafisat Abdulkadir · 5 authors

No abstract is available for this record.

Abhishree Sinha

Phishing attacks pose a significant security issue in Ethereum-based blockchain systems. Existing solutions, like TEGDetector, address these attacks by analysing how transactions evolve over time using Transaction Evolution Graphs (TEGs) constructed via time slicing, followed by a dynamic graph classifier that captures both spatial structure and temporal evolution with learned time coefficients. However, building and managing these graphs across multiple stages makes the overall approach complex and difficult to implement. In this work, we propose E2E-EmbedDetector, a lightweight end-to-end neural classification model that works directly with raw transaction data. The model learns embedding representations for important entities such as From, To, and ContractAddress, and also used two additional numeric features: transactional value and a derived input length. We train and evaluate the model on a balanced dataset of 50,000 Ethereum transaction using an 80/20 stratified split. The model achieves an accuracy of 95.63%, precision of 0.9265, recall of 0.9912, an F1 score of 0.9578, a ROC-AUC score of 0.9915 and a PR-AUC score of 0.9909. These results show that strong phishing can be achieved using a simpler and more practical tabular approach, without relying on complex temporal graph- based networks.

Fatemeh Erfan, Martine Bellaïche, Talal Halabi

Integrating blockchain into the Industrial Internet of Things (IIoT) has emerged as a promising solution for preserving data privacy and ensuring IoT security. Among various blockchain platforms, Ethereum stands out due to its support for smart contracts and its interoperability with lightweight communication protocols. Despite these advantages, particularly within Ethereum-based networks, IIoT systems remain vulnerable to large-scale threats such as Sybil attacks. These attacks pose a critical security risk because an adversary generates numerous fake entities to infiltrate and compromise the network, ultimately undermining its integrity and availability. Existing approaches utilize Ethereum smart contracts and lightweight protocols such as MQTT to secure IIoT communications, but often overlook sophisticated threats such as Sybil attacks, which introduce fraudulent nodes into the network. Conventional detection methods typically depend on centralized monitoring, undermining scalability and privacy, and there remains a lack of publicly available datasets representing adversarial behaviors in IIoT environments. In this paper, an Ethereum-based IIoT network is first developed, and a publicly available dataset is released through the GitHub repository. An advanced method is then proposed to detect and prevent Sybil attacks in a PoA-based IIoT network using decentralized federated learning. During the detection phase, a convolutional neural network (CNN) is employed within the decentralized federated learning framework, achieving an average detection accuracy and recall of 91.13% and 91.37% among clients, respectively. In the prevention phase, a secure smart contract is designed to manage a dynamic reputation system, effectively preventing Sybil nodes from remaining active on the network.

João Crisóstomo, Fernando Bação, Victor Lobo

This review explores the application of machine learning techniques for fraud detection and prevention in the Ethereum blockchain. As a leading platform for decentralized applications (dApps), Ethereum is vulnerable to fraudulent activities such as scams, hacking attempts, and malicious transactions. This paper provides a comprehensive analysis of machine learning models used to predict, detect, and mitigate fraudulent behavior within the Ethereum ecosystem. By overviewing various machine learning methods, this study identifies the most effective approaches for addressing different types of vulnerabilities while offering a thorough review of existing research, key challenges, and limitations. It also examines the datasets and feature engineering techniques applied in this domain, outlining future directions and potential strategies for improving fraud detection. While machine learning has enhanced Ethereum’s security, challenges such as data availability, adversarial attacks, and model interpretability remain significant concerns. To address these gaps, this study highlights the potential of integrating deep learning architectures, graph representations, and hybrid models that combine supervised and unsupervised learning. Additionally, it explores the use of active learning and genetic programming to further enhance fraud detection capabilities. Furthermore, leveraging AI, particularly through large language models, could improve interpretability at the account, block, or transaction level, offering a clearer, more comprehensive view of fraudulent behavior across the Ethereum network. By tackling these challenges, future advancements in machine learning could further strengthen the resilience, security, and trustworthiness of Ethereum’s infrastructure.