An address in the Bitcoin blockchain serves as an identifier for spending cryptocurrency. The blockchain itself does not contain information about the actual users who control the assets. Users have the ability to create multiple addresses, leading to the challenge of grouping addresses, also known as clustering, in order to analyze Bitcoin users. The grouping problem is a crucial initial step in the analysis of Bitcoin users. The grouping solution involves using heuristics based on usage patterns, with a focus on Common Spending (CS) and One-Time Change (OTC) in the current research. Additionally, anonymization techniques such as Shared Send Mixers (SSM) are considered in this paper as they prevent or at least complicate analysis. It is possible to untangle SSM, and based on the number of untanglings per transaction and their size, the transaction can be classified into a certain complexity class. Both heuristics and untangling were applied to the Bitcoin transaction history in our study. Our findings revealed that OTC misuse may occur in 19 to 26 percent of cases, depending on the specific algorithm used. Furthermore, CS and OTC were found to generate 13 to 0.8 percent of new cases when applied to subtransactions of separable SSM. Additionally, we demonstrated that SSM address grouping respects untangling complexity classes. In the future, we plan to adapt our workflow to other Bitcoin-like blockchains and modify our untangling algorithm to cover more SSM transactions.
The rise of cryptocurrencies has created new avenues for criminal money exchanges. Among various techniques, Bitcoin address clustering plays a crucial role in detecting and grouping addresses owned by the same entity. This fundamental step is essential for deanonymizing addresses and analyzing the flow of funds in the blockchain. This advancement contributes to the battle against illicit commerce, money laundering, fraud, scams, and similar activities. In this paper, we introduce two new heuristics, NSS and PEKET. NSS leverages Bitcoin non-standard scripts, while PEKET exploits the re-use of public keys to establish connections controlled by the same entity. Our contributions encompass (i) the detailed explanation of these two novel methods; (ii) the open-source publication of the tools we developed; and, (iii) the assessment of these heuristics using a proprietary extensive dataset of labeled addresses, which achieve precision levels of 1.0 and 0.979 respectively.
The role played by email communication in our lives nowadays has been such a tremendous one especially when it comes to fast exchange of information. Nevertheless, this convenience is marred by the omnipresent threat of email spam that not only disrupts channels of communication but also present serious security and privacy concerns. Traditional models of spam detection which are based on rules or heuristics tend to fail because they do not adapt quickly enough to the new techniques employed by spammers. In response to these challenges, this paper proposes an inventive solution to the problem—integration of blockchain technology into the process of detecting email spams.Email spam is often defined as an unwanted and usually malicious form of correspondence, thus it has continued being a notable cyber security worry. The conventional mechanisms for discovering them are prone to false positives and negatives at times. Additionally, such systems have centralized data which can be interfered with and accessed without permission. Weighing up the limitations inherent in existing methods, this research examines how blockchain may change email spam detection. Keywords— Blockchain technology, ethereum, Spam, email
Madhu B K, D Sowmya, N Spoorthi, Umme Kulsum · 5 authors
In this technology counterfeiting is very common and dangerous, also another consequence of counterfeiting is that a company’s reputation suffers. There are several methods such as RFID tags artificial intelligence blockchain and QR based systems etc. In our survey paper we are focusing mainly on blockchain techonlogy. Blockchain typically managed by peer-to-peer computer network for use as a public distributed ledger. The blockchain technology ensures identification and traceability of original product through the supply chain
Mining pools have been the driving force for ensuring the security of multiple proof-of-work (PoW) cryptocurrencies. Under the de facto protocol Stratum, pools allow miners to collaborate, discover new blocks, and earn rewards collectively. Recently, the blockchain community has been promoting the adoption of a more secure Stratum protocol known as Stratum V2. In this paper, we introduce Erosion, a novel network-level attack that applies to both Stratum and Stratum V2 protocols. The essence of the Erosion attack lies in its ability to disrupt connections between miners and a targeted mining pool, significantly impairing the miners’ contributed PoWs and reducing the victim’s mining power. We also discover a vulnerability in the Stratum V2 protocol that allows the adversary to persistently disrupt a connection by tampering with a single packet, thus enhancing the attack’s stealthiness. Our survey shows that the Erosion adversary can readily execute attacks against a significant majority (e.g., 91%) of mining pools across the top ten cryptocurrencies. We also observe an extreme mining centralization that enables Erosion adversaries to simultaneously target multiple pools and cryptocurrencies. Furthermore, our focused evaluation of pooled mining in Bitcoin reveals that thousands of different adversaries can gain control over the majority of Bitcoin mining power, with one potentially malicious Autonomous System capable of taking down 96% of the total mining power.
Public and permissionless blockchain systems are challenged by Sybil attacks, in which attackers use multiple identities to gain control.Traditionally, such attacks are prevented by consensus mechanisms relying on resource expenditure.However, such mechanisms (e.g.proof of work) face criticism for being wasteful.To address this and other concerns, novel blockchain systems backed by new consensus mechanisms have recently emerged.We formalise three key characteristics pursued by these systems: permissionlessness, Sybil attack resistance, and freeness.We demonstrate that no blockchain protocol can simultaneously achieve all three characteristics within the paradigm established by our formalisation.Thus, a trilemma emerges for distributed ledger technology designers, who must balance these characteristics thoughtfully.
The closed architecture of prevailing blockchain systems renders the usage of this technology mostly infeasible for a wide range of real-world problems. Most blockchains trap users and applications in their isolated space without the possibility of cooperating or switching to other blockchains. Therefore, blockchains need additional mechanisms for seamless communication and arbitrary data exchange between each other and external systems. Unfortunately, current approaches for cross-blockchain communication are resource-intensive or require additional blockchains or tailored solutions depending on the applied consensus mechanisms of the connected blockchains. Therefore, we propose an oracle with an off-chain aggregation mechanism based on Zero-Knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs) to facilitate cross-blockchain communication. The oracle queries data from another blockchain and applies a rollup-like mechanism to move state and computation off-chain. The zkOracle contract only expects the transferred data, an updated state root, and proof of the correct execution of the aggregation mechanism. The proposed solution only requires constant 378 kgas to submit data on the Ethereum blockchain and is primarily independent of the underlying technology of the queried blockchains.
Cryptocurrency wallets come in various forms, each with unique usability and security features. Through interviews with 24 users, we explore reasons for selecting wallets in different contexts. Participants opt for smart contract wallets to simplify key management, leveraging social interactions. However, they prefer personal devices over individuals as guardians to avoid social cybersecurity concerns in managing guardian relationships. When engaging in high-stakes or complex transactions, they often choose browser-based wallets, leveraging third-party security extensions. For simpler transactions, they prefer the convenience of mobile wallets. Many participants avoid hardware wallets due to usability issues and security concerns with respect to key recovery service provided by manufacturer and phishing attacks. Social networks play a dual role: participants seek security advice from friends, but also express security concerns in soliciting this help. We offer novel insights into how and why users adopt specific wallets. We also discuss design recommendations for future wallet technologies based on our findings.
The advent of Web3 technologies promises unprecedented levels of user control and autonomy. However, this decentralization shifts the burden of security onto the users, making it crucial to understand their security behaviors and perceptions. To address this, our study introduces a comprehensive framework that identifies four core components of user interaction within the Web3 ecosystem: blockchain infrastructures, Web3-based Decentralized Applications (DApps), online communities, and off-chain cryptocurrency platforms. We delve into the security concerns perceived by users in each of these components and analyze the mitigation strategies they employ, ranging from risk assessment and aversion to diversification and acceptance. We further discuss the landscape of both technical and human-induced security risks in the Web3 ecosystem, identify the unique security differences between Web2 and Web3, and highlight key challenges that render users vulnerable, to provide implications for security design in Web3.
Language models (LMs) have demonstrated superior performance in detecting fraudulent activities on Blockchains. Nonetheless, the sheer volume of Blockchain data results in excessive memory and computational costs when training LMs from scratch, limiting their capabilities to large-scale applications. In this paper, we present ZipZap, a framework tailored to achieve both parameter and computational efficiency when training LMs on large-scale transaction data. First, with the frequency-aware compression, an LM can be compressed down to a mere 7.5% of its initial size with an imperceptible performance dip. This technique correlates the embedding dimension of an address with its occurrence frequency in the dataset, motivated by the observation that embeddings of low-frequency addresses are insufficiently trained and thus negating the need for a uniformly large dimension for knowledge representation. Second, ZipZap accelerates the speed through the asymmetric training paradigm: It performs transaction dropping and cross-layer parameter-sharing to expedite the pre-training process, while revert to the standard training paradigm for fine-tuning to strike a balance between efficiency and efficacy, motivated by the observation that the optimization goals of pre-training and fine-tuning are inconsistent. Evaluations on real-world, large-scale datasets demonstrate that ZipZap delivers notable parameter and computational efficiency improvements for training LMs. Our implementation is available at: https://github.com/git-disl/ZipZap.
Peer-to-Peer (P2P) cryptocurrency exchanges are two-sided marketplaces, similar to eBay, where individuals can offer to sell cryptocurrencies in exchange for payment. Due to disintermediation, these marketplaces trade off increased privacy for higher risk (e.g., scams/fraud). Although these marketplaces use feedback systems to encourage healthier transactions, anecdotal evidence suggests that feedback often fails to capture vendor-associated risks. This work documents the online safety of cryptocurrency P2P marketplaces, identifies underlying issues in feedback-based reputation systems, and proposes improved mechanisms for predicting/monitoring risky accounts. We collect data from two cryptocurrency marketplaces, Paxful and LocalCoinSwap (LCS) for 12 months (06/2022--06/2023). The data includes over 396,000 listings, 67,000 vendors, and 4.7 million feedback for Paxful; and about 52,000 listings, 14,000 users, and 146,000 feedback for LCS.First, we show that the current feedback system does not sufficiently convey enough information about risky vendors, and is susceptible to reputation manipulation through user collusion and automation. Second, combining various publicly available information, we build machine learning models to predict account suspension, and achieve a 0.86 F1-score and 0.93 AUC for Paxful. Third, while our models appear to have limited transferability across markets, we identify which features most help account suspension across platforms. Finally, we perform a month-long online evaluation to show that our models are significantly more successful than mere feedback-based reputation schemes at predicting which users will be suspended in the future.
Daiki Ito, Yuta Takata, Hiroshi Kumagai, Masaki Kamizono
Traditionally, top-level domains (TLDs) are managed by the Internet corporation for assigned names and numbers (ICANN), and the domain names under them are managed by registrars. Against such a centralized management, a blockchain naming service (BNS) has been proposed to manage TLDs on blockchains without authority intervention. BNS users can register TLD strings as non-fungible tokens and manage the TLD root zone. However, such a decentralized management results in the introduction of a new security issue, BNS TLD name collision, wherein the same TLD is registered in several different BNSs. In this study, we investigated BNS TLD name collisions by analyzing TLDs registered on two BNSs: Handshake and Decentraweb. Specifically, we collected TLDs registered in Handshake and Decentraweb and the associated data, and analyzed the data registration status of BNS TLDs and BNS TLD name collisions. The analysis of 11,595,406 Handshake and 11,889 Decentraweb TLDs revealed 6,973 BNS TLD name collisions. In particular, lastname TLDs, which are intended for use as person names, yielded a large number of registered domain names. In addition, the analysis identified 10 name collisions between the BNS and operational ICANN TLDs. Further, the ICANN TLD candidates under review also had name collisions against the BNS TLDs. Consequently, based on the characteristics of these name collisions and discussions in BNS communities, we considered countermeasures against BNS TLD name collisions. For the further development of BNSs, we believe that it is essential to discuss with the existing Internet communities and coexist with the existing Internet.
Cryptocurrencies, while revolutionary, have become a magnet for malicious actors. With numerous reports underscoring cyberattacks and scams in this domain, our paper takes the lead in characterizing visual scams associated with cryptocurrency wallets---a fundamental component of Web3. Specifically, scammers capitalize on the omission of vital wallet interface details, such as token symbols, wallet addresses, and smart contract function names, to mislead users, potentially resulting in unintended financial losses. Analyzing Ethereum blockchain transactions from July 2022 to June 2023, we uncovered a total of 24,901,115 visual scam incidents, which include 3,585,493 counterfeit token attacks, 21,281,749 zero-transfer attacks, and 33,873 function name attacks, orchestrated by 6,768 distinct attackers. Shockingly, over 28,414 victims fell prey to these scams, with losses surpassing 27 million USD. This alarming data underscores the pressing need for robust protective measures. By profiling the typical victims and attackers, we are able to propose mitigation strategies informed by our findings.
Wenhan Hou, Bo Cui, Yongxin Chen, Ru Li · 5 authors
The rise of Ethereum in various economic and social domains has made it a prime target for illegal activities, particularly phishing scams, which has caused substantial financial losses. Existing methods mainly model transaction records as networks and classify nodes. However, a particular challenge is that not all transactions involved in phishing nodes are illegal, which makes phishing detection very difficult. In order to address the problem, in this paper, we propose a Curriculum Learning-based method for Ethereum phishing detection. We incorporate the Local Outlier Factor to measure the difficulty of nodes, considering the significant feature differences among nodes of the same class. By assigning lower difficulty values to easily identifiable nodes and higher difficulty values to nodes involved in mixed-class transactions, we ensure an effective difficulty measure. Then we gradually increase the number of training nodes input into Graph Convolutional Network in each epoch based on a certain ratio determined by the sorted difficulty scores. Finally, we employ LightGBM as the classifier for identifying phishing nodes. Experimental evaluations on a real-world Ethereum phishing scam dataset demonstrate the superiority of our method over baseline approaches, as evidenced by several evaluation metrics.
Cryptocurrency crime incidents in Ethereum are continuously rising, with phishing scams accounting for 50% of all criminal activities. The severe data imbalance significantly impacts the performance of Ethereum phishing detection models. The current solution may introduce redundant information or lead to the loss of important data. In this paper, we propose an Ethereum phishing detection method based on Graph Contrastive Learning with augmentations. This approach addresses the issue of insufficient learning of phishing node features, thus alleviating the influence of data imbalance on the model’s detection performance without disrupting the original data distribution. To enhance the representation of structural features, we employ two data augmentation methods: feature masking and edge perturbation. We conducted extensive experiments on a real Ethereum phishing dataset to evaluate the performance of our method. Compared to alternative methods, our approach not only significantly improves Precision, ranging from 12% to 30%, but also achieves noticeable enhancements in Recall, Auc, and F1-score. The experimental results provide ample evidence of the effectiveness of the proposed method.
Krishnendu Chatterjee, A. Ebrahimzadeh, Mehrdad Karrabi, Krzysztof Pietrzak · 6 authors
We study selfish mining attacks in longest-chain blockchains like Bitcoin, but where the proof of work is replaced with efficient proof systems -- like proofs of stake or proofs of space -- and consider the problem of computing an optimal selfish mining attack which maximizes expected relative revenue of the adversary, thus minimizing the chain quality. To this end, we propose a novel selfish mining attack that aims to maximize this objective and formally model the attack as a Markov decision process (MDP). We then present a formal analysis procedure which computes an $ε$-tight lower bound on the optimal expected relative revenue in the MDP and a strategy that achieves this $ε$-tight lower bound, where $ε>0$ may be any specified precision. Our analysis is fully automated and provides formal guarantees on the correctness. We evaluate our selfish mining attack and observe that it achieves superior expected relative revenue compared to two considered baselines. In concurrent work [Sarenche FC'24] does an automated analysis on selfish mining in predictable longest-chain blockchains based on efficient proof systems. Predictable means the randomness for the challenges is fixed for many blocks (as used e.g., in Ouroboros), while we consider unpredictable (Bitcoin-like) chains where the challenge is derived from the previous block.
As social media grows to entangle and remould the lives of people, so grows the concern over data privacy, censorship, server outages, and control over personal information by proprietary bodies due to their centralized design. The rise of blockchain has encouraged researchers to consider the decentralization framework for developing online social networks to resolve the challenges mentioned above. In a decentralized ecosystem, no one entity has absolute access to data and the power to enforce arbitrary decisions. The benefits of this include ownership over personal data, censorship resistance, data security, and improved control over user-generated content. In this paper, we propose the design of Ethnos, a social networking application built to harness the powers of blockchain and distributed storage technology to heighten the security and reliability of users as well as their data. In that context, suitable smart contracts have been fabricated. This paper also prospects integration of two-factor user authentication and trust score checks with Ethnos to corroborate the trustworthiness of both user and data. In addition, Ethnos incorporates a remuneration system to compensate users for their contribution to and engagement with the platform.
Lakshmi P. Krishnan, Iman Vakilinia, Sandeep Reddivari, Sanjay Ahuja
The exponential growth of cryptocurrencies in the last decade has been accompanied by a surge in illicit activities, such as pump-and-dump schemes, Ponzi schemes, and exit scams. These nefarious activities have proliferated through the manipulation of social media platforms. This work employs a multimodal approach to predict cryptocurrency price movements by analyzing social media data, search interest, tweet spikes, and historical cryptocurrency prices. Using data from social media discussions, we extract lexical and behavioral features that highlight sentiment shifts, influence tactics, and cross-platform correlations relevant to cryptocurrency price fluctuations. Using a Variational Autoencoder, this approach predicts cryptocurrency prices and unveils patterns of pump-and-dump attempts. With real-time deployment capabilities, this system not only aids investors in understanding and predicting price trends but also offers protection against scams that may coincide with unusual price fluctuations. Moreover, the techniques developed extend to detecting manipulation and organized inauthenticity beyond the realm of cryptocurrency, ensuring trust and security in digital systems.
Lakshmi P. Krishnan, Iman Vakilinia, Sandeep Reddivari, Sanjay Ahuja
Blockchain technology and cryptocurrencies have captured global attention due to their numerous and versatile features, resulting in several industries and services adopting cryptocurrencies as payment methods. The advantages including user anonymity, open source, and tamper-proof transactions, have contributed to its popularity. However, these advantages have also attracted scammers who exploit the technology's features to engage in fraudulent activities, leading to a growth in crypto-frauds. To prevent and identify these frauds, various detection and prevention methodologies have been proposed, mainly using machine learning algorithms to identify scams as anomalies or outliers. The performance of such models depends on the datasets used and the features engineered. Often, these models face the challenge of having limited amounts of data that are scam-labeled. Under such circumstances, the model performs poorly due to an imbalanced dataset. Similarly, the features engineered and selected to train the model are also very important in detecting scams. With the help of sampling techniques, we propose to create a dataset that is researchready and addresses the data imbalance problem. Additionally, we list the resources that can be used to collect labeled data. Furthermore, we discuss the practical significance of features and various feature engineering strategies in detecting scams from transactions in Ethereum.