Selfish mining attacks pose a significant and ongoing security threat to blockchain networks, including major platforms like Bitcoin and Ethereum. Understanding and effectively countering these attacks is crucial for maintaining the stability and integrity of these networks. This attack strategy involves a miner or a group of miners seeking to gain an advantage by delaying the immediate broadcasting of their mined blocks to the network. The selfish miners potentially mine more blocks in secret, increasing their rewards at the expense of other miners and the stability of the blockchain. Research has mainly focused on detecting this attack by analyzing data related to blocks and forks. This paper presents a new approach to efficiently detect selfish mining attacks in large-scale networks by analyzing various network indicators. To achieve this, we simulate a Bitcoin network and generate a dataset consisting of several features of individual miners and the overall network. We select the most reliable indicators by analyzing network features and reducing feature dimensions. Then, we employ random forest classification (RFC) to classify benign and selfish network behaviors. This approach not only achieves enhanced accuracy (99.96%), surpassing state-of-the-art methods utilizing deep learning, but also significantly reduces computational, storage, and temporal complexities. In doing so, it fortifies blockchain security more efficiently and accurately.
Internet introduce modern digital currencies which have evolved from our fiat currencies. As the world faced a recession driven by centralized assets, an evolution took place. Additionally, banks charged negative interests on tangible property. When money was in danger, the Internet provided a solution that altered the global system of currency control. Bitcoin the pioneering cryptocurrency that has revolutionized digital finance. An n unchangeable record of every transaction is kept through the use of blockchain technology in it. The public disclosure of a cryptocurrency's whole the formation and transaction history fosters user confidence. People on the Bitcoin network deal with one another using anonymous Bitcoin addresses, never disclosing their true identities. To optimize their privacy and convenience, individuals frequently utilize many distinct email addresses. In this study it also examines academic literature to understand the various uses of Bitcoin. A comprehensive review of existing research is conducted to detail the characteristics and applications of Bitcoin. The paper utilizes primary information from scholarly articles and secondary data from publicly accessible case studies that are relevant to the topic. Beyond developing Bitcoin faces several challenges, including regulatory uncertainty, scalability issues. Although its initial appearance seemed to indicate hope for a better future, now it is hard to predict how bitcoin will emerge.
A giveaway scam is a type of fraud leveraging social media platforms and phishing campaigns. These scams have become increasingly common and are now also prevalent in the crypto community where attackers attempt to gain crypto-enthusiastsโ trust with the promise of high-yield giveaways. Giveaway scams target individuals who lack technical familiarity with the blockchain. They take on various forms, often presenting as genuine cryptocurrency giveaways endorsed by prominent figures or organizations within the blockchain community. Scammers entice victims by promising substantial returns on a nominal investment. Victims are manipulated into sending cryptocurrency under the pretext of paying for "verification" or "processing fees." However, once the funds have been sent, the scammers disappear and leave victims empty-handed. This study employs essential blockchain tools and techniques to explore the mechanics of giveaway scams. A crucial aspect of an investigation is to meticulously trace the movement of funds within the blockchain so that illicit gains resulting from these scams can be tracked. At some point a scammer wants to โcash-outโ by transferring the funds to an off-ramp, for example, an exchange. If the investigator can establish a link to such an exchange, the identity of the owner of cryptocurrency address could be revealed. However, in organised scams, criminals make use of mules and do not use their own identities. The authors of this paper select a use case and then illustrate a comprehensive approach to investigate the selected scam. This paper contributes to the understanding and mitigation of giveaway scams in the cryptocurrency realm. By leveraging the mechanics of blockchain technology, dissecting scammer tactics, and utilizing investigative techniques and tools, the paper aims to contribute to the protection of investors, the industry, and the overall integrity of the blockchain ecosystem. This research sheds light on the intricate workings of giveaway scams and proposes effective strategies to counteract them.
The rapid advancement of blockchain technology has fueled the prosperity of the cryptocurrency market. Unfortunately, it has also facilitated certain criminal activities, particularly the increasing issue of phishing scams on blockchain platforms such as Ethereum. Consequently, developing an efficient phishing detection system is critical for ensuring the security and reliability of cryptocurrency transactions. However, existing methods have shortcomings in dealing with sample imbalance and effective feature extraction. To address these issues, this study proposes an Ethereum phishing scam detection method based on DA-HGNN (Data Augmentation Method and Hybrid Graph Neural Network Model), validated by real Ethereum datasets to prove its effectiveness. Initially, basic node features consisting of 11 attributes were designed. This study applied a sliding window sampling method based on node transactions for data augmentation. Since phishing nodes often initiate numerous transactions, the augmented samples tended to balance. Subsequently, the Temporal Features Extraction Module employed Conv1D (One-Dimensional Convolutional neural network) and GRU-MHA (GRU-Multi-Head Attention) models to uncover intrinsic relationships between features from the time sequences and to mine adequate local features, culminating in the extraction of temporal features. The GAE (Graph Autoencoder) concept was then leveraged, with SAGEConv (Graph SAGE Convolution) as the encoder. In the SAGEConv reconstruction module, by reconstructing the relationships between transaction graph nodes, the structural features of the nodes were learned, obtaining reconstructed node embedding representations. Ultimately, phishing fraud nodes were further identified by integrating temporal features, basic features, and embedding representations. A real Ethereum dataset was collected for evaluation, and the DA-HGNN model achieved an AUC-ROC (Area Under the Receiver Operating Characteristic Curve) of 0.994, a Recall of 0.995, and an F1-score of 0.994, outperforming existing methods and baseline models.
Lukas Ingmarsson, Karl Duckert Karlsson, Niklas Carlsson
Bitcoin and the Dark Web present an interesting synergy that enables both legitimate anonymity and illicit activities, making it an important landscape to understand, especially as the Dark Web, with its hidden services, relies heavily on Bitcoin as a pseudonymous currency for transactions. However, a lack of scalable tools and timely datasets has limited systematic analysis of this ecosystem. To address this gap, we introduce Venom, a scalable framework for mapping Bitcoin activity on the Dark Web. Venom integrates multithreaded crawling, data extraction, and dataset generation, resulting in a comprehensive resource that allows us to easily collect snapshots of over 177,000 onion sites in roughly 24 hours. With the paper, we share both the tool and an example snapshot containing both per-site metadata and Bitcoin transaction data. Preliminary analysis reveals concentrated activity among key players and widespread content mirroring, offering new insights into the Dark Web's economic structure. Venom provides a critical resource for advancing research and monitoring in this domain.
Chuyi Yan, Xueying Han, Yan Zhu, Dan Du ยท 6 authors
Abstract Despite the growing attention on blockchain, phishing activities have surged, particularly on newly established chains. Acknowledging the challenge of limited intelligence in the early stages of new chains, we propose ADA-Spear-an automatic phishing detection model utilizing a dversarial d omain a daptive learning which symbolizes the methodโs ability to penetrate various heterogeneous blockchains for phishing detection. The model effectively identifies phishing behavior in new chains with limited reliable labels, addressing challenges such as significant distribution drift, low attribute overlap, and limited inter-chain connections. Our approach includes a subgraph construction strategy to align heterogeneous chains, a layered deep learning encoder capturing both temporal and spatial information, and integrated adversarial domain adaptive learning in end-to-end model training. Validation in Ethereum, Bitcoin, and EOSIO environments demonstrates ADA-Spearโs effectiveness, achieving an average F1 score of 77.41 on new chains after knowledge transfer, surpassing existing detection methods.
Detecting phishing scams has become an important task in blockchain-based cryptocurrency applications. While many network representation learning-based approaches have been proposed for this task, they suffer from various issues including (1) the requirement of handcrafted features, which may not capture complex relationships and patterns in graph data, and/or (2) considering only node features while ignoring the more significant edge features, and/or (3) incapability of preserving complete network topology, which affects the generalization ability. In this paper, we propose a novel Edge-feature modeling-based Topological Graph Neural Network (ETGNN) to detect phishing scams on Ethereum, which avoids all aforementioned issues of existing approaches. Specifically, ETGNN involves two key components, one responsible for learning weighted features of nodes and edges in the Ethereum transaction graph, and the other responsible for incorporating global topological information of the graph using persistent homology. Finally, phishing scams are detected based on these two learned features. The experimental results demonstrate that ETGNN outperforms the state-of-the-art method with an improvement rate of 14.38% on F1-score.
Abstract A Web3 lifeworld consists of an imaginary and a shared commons. A Web3 imaginary is shown to include most, if not all, of the following: (i) the stated goal or purpose of the community, (ii) the behavioral norms, (iii) the lore or history, and (iv) what is opposed. A typical Web3 commons is shown to involve three elements: hash (technical), bash (social) and cash (finance). When changes come in Web3, the response is enacted using an available lever from the hash, bash, cash model of decentralized organization, but the response must not be in friction with the communityโs imaginary, or it will most likely grind to a halt. Effective response to change becomes part of the Web3 lifeworldโs toolkit.
The inherent anonymity of blockchain technology has made the cryptocurrency sector a breeding ground for a multitude of illicit financial crimes. In the realm of blockchain transaction security, phishing scams are widely considered a highly severe form of deceit, leading to significant economic losses. This paper provides an overview of past research findings on methods for detecting phishing scam in blockchain networks. Extending graph neural network approaches to detect phishing scam in blockchain networks will be of utmost importance. Graph neural networks yield models with superior generalization capabilities in comparison to conventional approaches. Future research will involve examining high-quality datasets and evaluating the influence of transaction graphs and transaction subgraphs on the effectiveness of detecting phishing scam nodes in categorization. The primary objective is to construct a more resilient model that can achieve the desired detection outcomes and differentiate phishing scams nodes with greater efficiency and precision.
Phishing scams are one of Ethereum's most representative security risks that can defraud many transactions in a short period and severely threaten network security. Existing deep learning-based phishing scam detection methods mainly rely on constructing static transaction graphs which are assumed to be accessible before model training. However, static methods that have a high false positive rate to detect newly generated phishing scams by adding this newly generated data to existing algorithms for execution, due to new accounts and transactions constantly appearing in the real-world Ethereum network. Therefore, this article, for the first time, proposes a novel evolve-based phishing scams detection method (named GrabPhisher) that extracts temporal features of accounts and captures information about the dynamic topology of the graph as it evolves. Specifically, GrabPhisher can build the evolutionary pattern of accounts trading on Ethereum as a diffusion network graph in continuous time. It can continue to capture new transaction features based on existing transactions, which facilitates the identification of phishing accounts. Additionally, we implement GrabPhisher on the real-world Ethereum phishing scams datasets. Extensive experimental results demonstrate that GrabPhisher can effectively extract dynamic temporal features and outperform state-of-the-art methods (95% Recall, and 88% F1-score).
Blockchain, as an emerging technology, has gained widespread research in academia and industry due to its decentralization and traceability. As an important form of blockchain, consortium chains are often applied in the Internet of Things (IoT) to ensure the authenticity and reliability of data. Within consortium chains, the practical Byzantine fault tolerance (PBFT) method is a key technology for ensuring the data consistency. It plays a central role in enhancing the system performance, security, and scalability. However, with the increase in the number of user nodes and the diversification of application scenarios, PBFT faces significant challenges in maintaining performance and security, particularly due to the increased communication overhead, longer consensus latency (CL), and risks of malicious attacks on the leader node. To overcome these challenges, this article proposes a new blockchain consensus mechanism, namely the reputation awareness randomization consensus mechanism in the blockchain systems (RARCs). This mechanism first builds an evaluation model for the nodes, dividing them into ordinary nodes and candidate nodes through the reputation assessment. Second, it constructs a consensus node selection strategy to select the high-quality consensus nodes from the candidate nodes. Finally, RARC establishes a leader node randomization selection mechanism, increasing the unpredictability of the leader node and reducing the probability of the malicious attacks. Through the theoretical analysis and simulation experiments, we demonstrate that the RARC can significantly reduce the CL, enhance the throughput, and increase the unpredictability of the leader node, thereby improving the performance and security of the blockchain systems.
Ethereum is the second-largest blockchain platform, and the financial value of its cryptocurrency has constantly increased. Unfortunately, regulatory challenges have resulted in a surge of scams, particularly phishing, which now accounts for over 50% of fraudulent funds. Therefore, phishing scam issues have become a top priority, thus calling for dynamic early warning and accurate identification to achieve effective market regulation. However, the existing works focusing on phishing address detection do not consider early warnings for phishing scams. Furthermore, these methods depend on static graphs to extract node information and overlook the dynamic evolution process of the Ethereum network. In this article, we propose EWDPS, a novel framework to achieve dynamic early warning and effectively identify phishing scams on Ethereum. Specifically, we create a new network called the dynamic temporal transaction network (DTTN), which effectively models the dynamic temporal evolution of transactions. In DTTN, we propose the concepts of temporal evolution interaction network and account feature interaction network. Next, we design a novel feature extraction module to capture temporal sequential patterns effectively. This module takes full advantage of the dynamic interaction process of node-related transactions. Finally, we innovatively use the extracted account, network, and temporal features to enhance transaction representation in multiple dimensions. Extensive experiments show that our proposed scheme effectively achieves dynamic early warning and accurately identifies phishing scams. EWDPS achieves 92.20% accuracy, 95.90% precision, 96.77% recall, and 96.53% F1-score, and outperforms the state-of-the-art methods in phishing address identification.
Amir M. Ebrahimi, Bram Adams, Gustavo A. Oliva, Ahmed E. Hassan
The proxy pattern is a well-known design pattern with numerous use cases in several sectors of the software industry. As such, the use of the proxy pattern is also a common approach in the development of complex decentralized applications (DApps) on the Ethereum blockchain. Despite the importance of proxy contracts, little is known about (i) how their prevalence changed over time, (ii) the ways in which developers integrate proxies in the design of DApps, and (iii) what proxy types are being most commonly leveraged by developers. This study bridges these gaps through a comprehensive analysis of Ethereum smart contracts, utilizing a dataset of 50 million contracts and 1.6 billion transactions as of September 2022. Our findings reveal that 14.2% of all deployed smart contracts are proxy contracts. We show that proxy contracts are being more actively used than non-proxy contracts. Also, the usage of proxy contracts in various contexts, transactions involving proxy contracts, and adoption of proxy contracts by users have shown an upward trend over time, peaking at the end of our study period. They are either deployed through off-chain scripts or on-chain factory contracts, with the former and latter being employed in 39.1% and 60.9% of identified usage contexts in turn. We found that while the majority (67.8%) of proxies act as an interceptor, 32.2% enables upgradeability. Proxy contracts are typically (79%) implemented based on known reference implementations with 29.4% being of type ERC-1167, a class of proxies that aims to cheaply reuse and clone contracts' functionality. Our evaluation shows that our proposed behavioral proxy detection method has a precision and recall of 100% in detecting active proxies. Finally, we derive a set of practical recommendations for developers and introduce open research questions to guide future research on the topic.
Ruichao Liang, Jing Chen, Cong Wu, Kun He ยท 9 authors
Ponzi schemes, a form of scam, have been discovered in Ethereum smart contracts in recent years, causing massive financial losses. Existing detection methods primarily focus on rule-based approaches and machine learning techniques that utilize static information as features. However, these methods have significant limitations. Rule-based approaches rely on pre-defined rules with limited capabilities and domain knowledge dependency. Using static information like opcodes for machine learning fails to effectively characterize Ponzi contracts, resulting in poor reliability and interpretability. Our research shows no significant difference between Ponzi and non-Ponzi contracts at the opcode level. Moreover, relying on static information like transactions for machine learning requires a certain number of transactions to achieve detection, which limits the scalability of detection and hinders the identification of 0-day Ponzi schemes. In this article, we propose PonziGuard , an efficient Ponzi scheme detection approach based on contract runtime behavior. Inspired by the observation that a contractโs runtime behavior is more effective in disguising Ponzi contracts from the innocent contracts, PonziGuard establishes a comprehensive graph representation called contract runtime behavior graph (CRBG), to accurately depict the behavior of Ponzi contracts. Furthermore, it formulates the detection process as a graph classification task on CRBG, enhancing its overall effectiveness. The experiment results show that PonziGuard surpasses the current state-of-the-art approaches in the ground-truth dataset, achieving a precision of 96.9%, recall of 98.2%, and F1-score of 97.5%. It also exhibits the highest level of interpretability among the current tools. We applied PonziGuard to Ethereum Mainnet and demonstrated its effectiveness in real-world scenarios. Using PonziGuard , we identified 805 Ponzi contracts on Ethereum Mainnet, which have resulted in an estimated economic loss of 281,700 Ether or approximately \($\) 500 million USD. We also found 0-day Ponzi schemes in the recently deployed 10,000 smart contracts.
Adnan Ramzan, Hina Amir, Muhammad Atif Ur Rehman, Muhammad Ikram Ashraf
The findings of our extensive review of the cryptocurrency literature from 2010 to 2022 are presented in this report. We cover the definitions, history, uses, and distinctive activities of the cryptocurrency business in our overview. We initially conducted a bibliometric analysis on articles acquired from the Scopus database using the VOSviewer bibliometric and R package tool in order to identify the two main streams of cryptocurrency literature. Then, we conducted content analyses on pertinent publications from reputable sources. We also found gaps in the literature and suggested seven research areas that should be addressed in follow-up studies to improve understanding of the cryptocurrency sector. Researchers researching at the numerous sides of cryptocurrencies to increase our understanding of this industry may find the findings of this paper to be a helpful resource.
As the field of Web3 continues its rapid expansion, the security of Web3 authentication, often the gateway to various Web3 applications, becomes increasingly crucial. Despite its widespread use as a login method by numerous Web3 applications, the security risks of Web3 authentication have not received much attention. This paper investigates the vulnerabilities in the Web3 authentication process and proposes a new type of attack, dubbed blind message attacks. In blind message attacks, attackers trick users into blindly signing messages from target applications by exploiting users' inability to verify the source of messages, thereby achieving unauthorized access to the target application. We have developed Web3AuthChecker, a dynamic detection tool that interacts with Web3 authentication-related APIs to identify vulnerabilities. Our evaluation of real-world Web3 applications shows that a staggering 75.8% (22/29) of Web3 authentication deployments are at risk of blind message attacks. In response to this alarming situation, we implemented Web3AuthGuard on the open-source wallet MetaMask to alert users of potential attacks. Our evaluation results show that Web3AuthGuard can successfully raise alerts in 80% of the tested Web3 authentications. We have responsibly reported our findings to vulnerable websites and have been assigned two CVE IDs.
Ethereum, as one of today's most active blockchain platforms, provides extensive data for academic interest, thanks to its transparency and has garnered broad academic interest. Many studies model Ethereum transaction records as graph structures and design models to analyze phishing address transaction features. However, they often neglect the deep network structure of transaction sub-calls and lack efficient random walk strategies for optimal subgraph sampling. Therefore, this study introduces PR-Graph2vec, a PageRank- based graph embedding algorithm that captures the topological features of network phishing attacks from both the contract and sub-call perspectives, thereby improving phishing address detection. We extracted all transactions labeled as phishing from the blockchain explorer EtherScan to build a transaction network graph. Then, by aggregating the features of transaction call types and account types, we performed in-depth feature mining on transaction sub-calls. Finally, we used PageRank for biased sampling, significantly reducing the graph size. Experimental results demonstrate that our proposed Ethereum phishing detection model, PR-Graph2vec, excels in practical applications, achieving 91.0% precision and an 86.9% F1-score.
Supervising illicit activities on blockchain networks, such as money laundering, fraud, extortion, Ponzi schemes, and funding for terrorist organizations, presents significant challenges. Emerging machine learning methods for detecting abnormal transactions face hurdles due to high labeling costs, limited labeled data, and data imbalance. To address this, this paper proposes aMinimalSubstitution-basedLabelPropagation(MSLP) model to provide more labeled data to balance the graph data and complement the sample for anomalous transaction detection service in the blockchain networks. As far as we know, MSLP is the first method that utilizes the minimal substitution theory from the social computing field to find more abnormal transactions with under-labeling budget constraints. This approach has the potential to obtain more high-quality labeled data with minimal computational cost by utilizing a small amount of labeled graph data. Then, a label evaluation mechanism is proposed to decide the number of samples to be adopted for each class, ensuring the performance of downstream graph neural networks. Finally, extensive experiments were conducted and the proposed model improved the F1 score of illegal transaction node detection by 2.6% to 8.2%.