Bitcoin (BTC) wealth distribution is often studied with macro indicators like wallet balances, prices, network activity, fees, and hashrate. This letter proposes a "Crypto-Microeconomic Observability Framework" to examine micro-level Bitcoin wealth disparities across five labeled agent classes: Service, Abuse, Malware, Individuals, and Benign. Using descriptive, inequality, and longitudinal concentration metrics, we show that Bitcoin wealth is highly concentrated across major classes, consistent with a persistent "Whale-Effect". Service entities hold the largest share of observed BTC (75.15%), while Abuse controls a disproportionately large share relative to its entity count (24.26% of BTC vs. 3.53% of entities). Individuals, Abuse, and Service show near-maximal within-class inequality (e.g., Gini = 0.9993 for Individuals), and time-series analysis indicates these patterns persist. Overall, Bitcoin wealth among labeled economic agents remains structurally uneven and concentrated in a small subset of entities.
Since the first implementation of a blockchain with Bitcoin in 2009, cryptoassets created and transacted using blockchain technologies have grown and diversified significantly. Because regulatory regimes, which govern cryptoassets, do not have global coverage, criminal actors find opportunities to commit cryptoasset fraud. While it can be difficult to distinguish between cryptoassets that are honest but high risk and cryptoassets that are outright fraudulent, investors seeking significant returns frequently invest in unregulated cryptoassets, namely cryptocurrencies and non-fungible tokens (NFTs). This study provides a crime script analysis to examine the chronological and functional steps offenders use to execute cryptoasset fraud. It considers three types of crypto asset fraud and how they have functioned over time: Ponzi schemes, cryptoasset exit scams, such as cryptocurrency “rug pulls,” and NFT “mint-and-run” schemes, where invested value is stolen from a crypto asset project. By outlining the fundamental crime script of cryptoasset fraud, this study considers the implications for regulators. Of note, this study shows that while the stages of cryptoasset frauds are consistent, the speed at which frauds are executed has, on average, increased significantly. This rapidity of execution provides enduring challenges to regulators, who often cannot respond quickly. This challenge must be considered if regulation is to be effective.
Elena Baninemeh, Marre Slikker, Katsiaryna Labunets, Slinger Jansen
Purpose This study aims to investigate the impact of cybersecurity vulnerabilities on the effective implementation of distributed ledger technologies (DLTs), addressing a critical gap in the existing literature. This research seeks new insights into the detection and mitigation of specific attacks, such as selfish mining and Sybil attacks, contributing to a deeper understanding of cybersecurity risk assessment in DLT applications. Design/methodology/approach This study uses a mixed-methods approach, using a literature review combined with method engineering. Data were collected from an extensive database of known security threats, documented attacks on DLTs and associated countermeasures. The proposed method was evaluated through three case studies, with each organization applying the security risk assessment method developed in this study. Findings The results of this study reveal that the proposed security risk assessment method effectively identifies and addresses cybersecurity threats specific to distributed ledger applications. Case studies demonstrate that the method enables organizations to systematically evaluate and mitigate risks, offering evidence that comprehensive countermeasures can significantly enhance security. These findings confirm the practicality of the proposed method and reveal new patterns in organizational responses to cybersecurity threats in distributed ledger environments. Originality/value This research offers a novel perspective on the intersection of cybersecurity and DLTs, providing valuable insights into risk assessment frameworks tailored for this domain. This study’s findings contribute to the advancement of cybersecurity practices in distributed ledger applications, highlighting critical areas for future research and practical guidelines for organizations aiming to enhance their cybersecurity posture.
Blockchain technology is a groundbreaking decentralized electronic registry that captures transactions and data on a network of computers in an insecure, transparent and tamper-proof context. At its most fundamental level, blockchain systematizes the information framed into blocks and each block includes a list of transactions or documents, a timestamp and a cryptographical hash connecting it to the last block creating an immutable chronological chain. In contrast with the conventional and centralized databases, which are managed by one party, blockchain runs on a distributed system of nodes where each one of them keeps an identical copy of the registry. This architecture ensures elimination of single points of failure and improves on the use of intermediaries. Consensus mechanisms, like Proof-of-Work or Proof-of-Stake, are used to authenticate transactions and provide agreement among participants prior to the addition of new blocks. This chapter explores the use of blockchain technologies in scientific criminal investigations.
This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by rekt.news, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative losses yet represent a negligible share of published audit findings. Third, realised losses exhibit extreme concentration: the eight largest incidents account for 50.6% of cumulative dollar losses and the twenty largest for 71.4%, a distributional shape inconsistent with Gaussian assumptions. Throughout, we adopt the analytical convention that audit outputs and exploit outputs describe different populations and present the two datasets in parallel rather than as directly comparable samples.
Yuanyuan Zhang, N. J. Lord, Stephen Chan, Jeffrey Chu · 5 authors
This study examines the relationship between global phishing crime and cryptocurrency-market conditions, with a specific focus on Ethereum. Using monthly data from January 2016 to December 2022, we analyse the returns of global phishing crime numbers together with six Ethereum financial metrics relating to transactions, trading volume, and price impact. We employ quantile regression, quantile-on-quantile regression, and Granger causality in quantiles to examine whether the relationship between Ethereum market indicators and phishing activity varies across different market states. The results reveal a state-dependent relationship. Large increases in phishing crime numbers are strongly associated with large increases in Ethereum transaction activity, average transaction price, and transaction quantity, while implicit transaction cost is predominantly negatively associated with phishing activity, particularly at the upper quantiles. These findings suggest that phishing risk is most pronounced during extreme market conditions and may be shaped by both reward-enhancing market activity and cost-enhancing transaction frictions. To interpret these patterns, we develop an incentive-based criminogenic mechanism in which Ethereum market conditions affect phishing activity through offenders’ expected payoff. We identify two mediating channels: a monetisation-frictions channel, operating through liquidity, price impact, slippage, and transaction costs; and an attention/information-asymmetry channel, operating through volatility, speculative attention, fear of missing out, and user vulnerability. The findings provide initial evidence that cryptocurrency-related phishing is not only a technical cybersecurity issue, but also a market-sensitive phenomenon shaped by financial incentives, liquidity conditions, and behavioural vulnerability. These insights can support regulators, law enforcement agencies, and cryptocurrency platforms in developing adaptive early-warning and prevention strategies.
Kabilesh C M, Dr. B. Raja, Dr. S. Geetha, Dr. V. Cyrilraj
As decentralized finance (DeFi) continues to scale, traditional forensic methodologies often fail due to their retrospective, "post-mortem" nature, analyzing illicit activities only after they are permanently recorded on the ledger. This project proposes coinEth, a real-time institutional blockchain surveillance and autonomous defense system designed for the Ethereum Sepolia network. The framework operates across a four-layer architecture: a Data Acquisition Layer that intercepts pending transactions via Alchemy WebSockets (WSS); a Persistence and Forensic Engine that utilizes SQLite and Python-based heuristics to detect suspicious behavioral patterns such as "structuring" and "high velocity"; a Governance Layer that executes an autonomous enforcement loop via a Solidity-based "Gatekeeper" smart contract; and a Visualization Layer built with Streamlit and PyVis. By assigning dynamic risk scores—categorized as Safe (Level 0), Warning (Level 1), and Frozen (Level 2)—the system can automatically broadcast on-chain transactions to freeze illicit accounts before fund exfiltration occurs. Furthermore, coinEth reconstructs a chronological "money trail" through sequential path mapping (T0 → T1 → T2...), ensuring a verifiable digital chain of custody for investigative reporting. This proactive approach shifts blockchain security from passive observation to active, real-time intervention, significantly enhancing the defense mechanisms available to institutional stakeholders.
Blockchain technology solves central Internet of Things (IoT) forensics challenges—data volatility, device heterogeneity, and chain-of-custody integrity—via decentralized immutability, cryptographically secure systems, and smart contract automaton. Standard forensic software and hardware are not successful in distributed IoT contexts due to centralized reliance and evidence tampering vulnerabilities. Blockchain deployment uses layered architectures (device/edge/blockchain layers) where edge nodes process data in advance and on-chain hashes (e.g., using SHA-256) lock forensic logs onto immutable blockchains. Smart contracts make automation of evidence gathering and custody management tracking, and off-chain storage (e.g., InterPlanetary File System (IPFS)) support big data. Public blockchains like Ethereum and permissioned blockchains like Hyperledger Fabric support contextualized deployments, as seen in smart home, healthcare, and industrial IoT applications. Age-old problems are settling blockchain immutability with General Data Protection Regulation (GDPR) “right to erasure,” scalability for massive-volumes of IoT data with sharding/Layer 2 solutions, and zero-knowledge proofs for upholding privacy. New trends are artificial intelligence (AI)-based anomaly detection, quantum-resistant cryptography, and forensic admissibility standard frameworks (NIST/IEEE).
Current blockchain research and analytics tend to prioritize observable on-chain transactions, obscuring the processes through which cryptocurrencies are created, publicised, retained, and disposed of. In response, this paper considers distributed ledger technologies from records management principles in ISO 15489-1:2016. Setting off by specifying the parallels -- that is transactions as "records", crypto-asset units as "information assets", and blockchains as "aggregations" -- we introduce a seven-stage lifecycle for blockchain data. We apply the framework to Bitcoin, a fungible token, and a non-fungible token. On this basis, we argue that blockchain systems are not merely transactional infrastructures but record management systems with distinctive characteristics. We discuss how the on-chain/off-chain boundary and privacy-enhancing technologies can complicate lifecycle visibility, with particular relevance for crypto-crime research and investigation. As a meta-level framework, the lifecycle perspective enables positioning existing research, decomposing legal, regulatory, technological, and operational challenges by stage, and informing lifecycle-aware approaches to blockchain governance, analytics, and regulation.
The rapid expansion of the digital financial assets (DFA) market in Russia offers new opportunities for market participants while simultaneously creating fresh challenges and risks of financial crimes. The author examines the economic and legal nature of digital rights within the context of Federal Law No. 259-FZ and assesses the effectiveness of current regulations. An analysis of recent judicial and market practices reveals specific predicate and direct risks to the anti-money laundering system, including “controlled defaults” by issuers, fraud, and the emergence of Ponzi schemes. The article also highlights the lack of standardized smart contracts in this market, which complicates the verification of distributed ledger algorithms. Current threats associated with the use of generative artificial intelligence for creating “money mules” and synthetic identity fraud are identified. Based on a comparison of Russian experience with the regulatory approaches of the USA and Thailand, the necessity of forming a proactive legal environment is justified. Recommendations include the need to align regulatory regimes for traditional and digital financial assets and to enhance the professional qualifications of the judiciary.
The rapid expansion of cryptocurrency markets has fundamentally transformed the global financial system and challenged traditional approaches to financial regulation. Cryptocurrency exchanges have emerged as key intermediaries facilitating the purchase, sale, transfer, and storage of digital assets across jurisdictions. However, the borderless and decentralized nature of cryptocurrencies has generated significant legal concerns relating to anti-money laundering compliance, counter-terrorist financing measures, consumer protection, taxation, cybersecurity, market manipulation, and regulatory enforcement. This article examines international legal frameworks governing cryptocurrency exchanges, analyzes regulatory approaches adopted by leading jurisdictions, including the European Union and the United States, and evaluates major enforcement actions involving Binance and FTX. The study further explores emerging challenges associated with decentralized finance (DeFi) and proposes recommendations aimed at strengthening international cooperation and harmonizing legal standards for digital asset regulation.
Olha Kovalchuk, Ruslan Shevchuk, Serhiy Banakh, N. P. Holota · 6 authors
Abstract This study examines the relationships between national cryptocurrency regulation, anti-money laundering (AML) risks, and decentralized finance (DeFi) adoption across global jurisdictions. Using correspondence analysis, correlation techniques, and regression modeling with control variables, we analyze data from the Basel AML Index and Retail DeFi Rankings to identify structural patterns in the interaction between regulatory frameworks, institutional quality, and digital asset ecosystems. The results reveal a counterintuitive global distribution in which advanced economies with strong regulatory regimes and low AML risks tend to exhibit limited retail DeFi activity, whereas jurisdictions characterized by weaker institutions and higher money laundering risks show significantly higher levels of DeFi usage. Further, the correspondence analysis identifies three distinct clusters of countries defined by specific configurations of regulatory approaches, AML effectiveness, and DeFi adoption, indicating that these relationships are configurational rather than purely linear. Robustness checks demonstrate that qualitative features of regulatory regimes are more strongly associated with DeFi adoption than conventional quantitative indicators of economic development or governance quality, thereby distinguishing DeFi diffusion from broader cryptocurrency usage dynamics. Mediation analysis provides partial support for a compensatory pattern: financial inclusion is a significant negative predictor of DeFi adoption, though a statistically confirmed mediation pathway between AML risk and DeFi activity through financial exclusion was not established. The study also highlights substantial global regulatory fragmentation, with 57% of jurisdictions classified as “Undecided” or “Improving,” underscoring the ongoing difficulty of reconciling financial innovation with stability and risk mitigation. These findings provide evidence-based guidance for policymakers designing adaptive regulatory frameworks and establish a foundation for further research on the evolution of digital finance regulation.
Andreas Polyvios Delladetsimas, Elias Iosif, Stamatis Papangelou, George Giaglis
This article examines blockchain as an enabling technological component for data management tasks that are independent of currency-related functionality, a less-discussed aspect of a technology commonly associated with cryptocurrencies and decentralized finance (DeFi). Drawing on empirical findings from the DIGI4ECO project as a case study, we present a structured literature review and cross-domain analysis of blockchain-based data management systems (BDMSs), examine a representative permissioned BDMS implementation, and synthesize practical design guidelines and implementation insights for BDMS development. This perspective is motivated by core blockchain properties such as immutability and transparency, as well as by the observation that existing resources for BDMS development, including methods, tools, and best practices, remain fragmented and less developed than those available for more mature technologies.
Mingshun Ye, Dezhi Han, Chin‐Chen Chang, Mingdong Tang · 6 authors
The rapidly expanding Ethereum ecosystem has driven the flourishing of decentralized applications, but has also brought increasingly severe security risks. Ponzi scheme, in particular, pose a grave threat to platform security and user assets by luring investors with promises of high returns. The current detection methods generally suffer from limitations such as insufficient feature extraction, reliance on a single information source, and poor robustness. To address these challenges, this paper proposes a novel Multi-View Multi-Modal Fusion Framework with Large Language Models for Ponzi scheme detection on Ethereum, named MF2LLM. We first model the contract opcode sequence as an opcode chain graph and design a Time-Stamped Graph Encoder (TS-GE) to capture local temporal dependencies and execution flow relationships between opcodes. Concurrently, we construct an opcode semantic hypergraph based on semantic categories and design a Semantic-Weighted Hypergraph Encoder (SW-HGE) to model higher-order co-occurrence patterns and global associative features. Furthermore, we propose the Opcode Sequence Lightweighting (OSL) method, which significantly compresses the length of opcode sequences while preserving core control logic and semantic information. This provides high-quality structured input for information fusion. To this end, we perform multi-modal instruction fusion on multi-source heterogeneous features and employ LoRA to fine-tune LLMs. This enables the model to achieve cross-modal semantic reasoning and behavioural pattern recognition. Through extensive experimental validation on real-world datasets, MF2LLM demonstrates stable and superior detection performance even under conditions of highly imbalanced sample distributions. Compared to existing state-of-the-art approaches, our method outperforms across all metrics, achieving an ACC of 99.43%, Precision of 96.57%, Recall of 97.06%, and an F1-score of 96.81%. The efficiency and practical value of MF2LLM in detecting Ponzi schemes on Ethereum contribute to enhanced security for the decentralized application ecosystem. The codes are publicly available on Github: https://github.com/yemisua/MF2LLM.
Many blockchain-based cyber threat intelligence (CTI) sharing systems emphasize immutability and auditability, but often treat CTI submissions as ordinary blockchain transactions without explicitly separating content validation from publication anchoring. This paper presents CTIB, a proof-of-concept hybrid Proof-of-Stake (PoS) and Proof-of-Work (PoW) framework for CTI publication. CTIB uses a sequential workflow in which a PoS committee first evaluates CTI submissions, and an accepted feed hash is then anchored through a PoW step to provide verifiable temporal binding. The prototype is evaluated in a controlled local Hardhat environment; therefore, the results should be interpreted as prototype-level feasibility evidence rather than production-scale deployment results. CTI content is represented using STIX 2.1, canonicalized, and hashed using SHA-256; only integrity-critical evidence is stored on-chain, while full CTI content remains off-chain. Experimental results demonstrate prototype-level feasibility, with measured throughput, latency, and success rate metrics under different PoW difficulty profiles. Across ten independent local runs, CTIB achieved an average throughput between 141.13 and 166.14 feeds/min, average p50 latency between 326.18 and 403.09 ms, and average p95 latency between 553.22 and 700.82 ms under the tested difficulty profiles. Security analysis uses analytical modeling, committee capture probability, and Monte Carlo simulation to evaluate majority-attack feasibility under stated assumptions. The results indicate that sequential compromise of both validation and anchoring layers increases the cost of coordinated manipulation.
Eunchan Park, Kyonghwa Song, Won Hoi Kim, Wonho Song · 5 authors
Traditional blockchain untraceability schemes, such as mixers and privacy coins, obscure the sender-receiver relationship by placing transfers within an anonymity set. This paper studies a stronger goal: whether the transfer event itself can be made unobservable by blending into common decentralized-finance (DeFi) activity. We introduce Deniable Covert Asset Transfer (DCAT), a class of transfers that stage common loss-producing events, such as sandwich and arbitrage operations, so that a sender appears to suffer an ordinary loss while the receiver appears to profit from it. We design and validate two DCAT instantiations: a sandwich-based transfer on Ethereum and an arbitrage-based transfer on Arbitrum. Our experiments show that, under the evaluated settings, DCAT transfers are empirically unobservable on both chains. They are syntactically identical to corresponding maximal extractable value (MEV) activities, classified as ordinary extractions by standard MEV detection tools, and leave the sender and receiver unlinked under representative forensic tools. Since syntactic inspection cannot distinguish DCAT from ordinary MEV activity, we examine whether economic semantics provide useful forensic signals. Through a large-scale study of MEV losses on Ethereum and Arbitrum, we show that key semantic features follow power laws. Extreme losses and repeatedly exploited addresses occur in the wild, and thus are not by themselves definitive evidence of collusion. This gives staged transfers plausible deniability and makes fixed-threshold detection prone to false positives. We therefore develop a multivariate statistical method for forensic triage that ranks incidents by the joint rarity of their economic footprint. Applied to real-world DeFi activity, our method narrows a large search space to suspicious cases for manual investigation; we present three such cases to illustrate this prioritization.
In this paper, we examine the patterns and determinants of cross-border cryptocurrency flows. While our analysis focuses primarily on Bitcoin flows, the cryptocurrency with the largest market capitalization, we show that our key results also extend to four major stablecoins. After documenting global patterns of cross-border Bitcoin flows and contrasting them with those of traditional capital flows, we employ a cross-country panel approach to identify the key drivers of cross-border crypto flows for up to 162 countries. Our results provide evidence for the presence of multiple coexisting motives. The most significant motives comprise strategies to adjust to unfavorable macro and financial developments, as well as the need to conduct international payment and remittance transfers. Moreover, by conducting a case study of cross-border Bitcoin flows after the COVID-19 shock, we find that these motives were particularly relevant at a time when economic conditions were weak and the need for remittances appeared high. Gaining a better understanding of the motives behind cross-border cryptocurrency transactions is crucial for informing the public debate on cryptocurrencies and their potential use cases.
This chapter explores the use of on-chain and off-chain tools for cryptocurrency investigations, including Maltego, SpiderFoot, and i2 Analyst&s;s Notebook. It also covers the application of machine learning, AI , and data science, as well as network analysis tools, in crypto investigations. The chapter concludes with a discussion of cryptocurrency crime scene investigation.
Part II, 'How Decentralised Security is Organised,’ examines the actors, infrastructures, and incentives that shape security practices in Web3—from the structural insecurity of digital infrastructure to the emergent role of white hat hackers and collaborative security initiatives they coordinate. This chapter introduces a new protagonist in the security landscape: the blockchain white hat hacker. Far from operating in the shadows, this actors play a vital role in the moral, political, and economic landscape of blockchains by helping to safeguard decentralised systems. This chapter examines the practices, motivations and incentives—both financial, moral, and reputational—that drive white hat activity, highlighting how these individuals contribute to vulnerability disclosure, incident response and the overall resilience of the blockchain ecosystem. In doing so, it situates white hats not as central figures in the evolving ecosystem of decentralised security governance.
The growing digitalisation of the tourism sector has led to increased vulnerability to cross-border cybercrime, exposing gaps in international legal cooperation. This study examines the legal and jurisdictional challenges in collecting and admitting digital evidence in tourism-related cybercrime. It analyses key international frameworks, including the Budapest Convention, UNTOC, and the EU-US Data Privacy Framework, highlighting conflicts in data sharing and evidence admissibility. Case studies such as Marriott, British Airways, and MakeMyTrip reveal inconsistencies in cross-border investigations. The paper also explores the role of blockchain and zero-knowledge proofs in improving evidence integrity, while raising concerns over privacy rights under ICCPR and ECHR. Findings suggest the need for legal harmonisation, streamlined evidence-sharing procedures, and enhanced forensic capabilities to strengthen cybercrime response in the tourism industry.
The increasing complexity of global financial systems has necessitated the adoption of more efficient and transparent mechanisms for combating money laundering (AML). Blockchain technology, with its decentralized, immutable, and transparent characteristics, presents a promising solution to address the limitations of traditional AML systems. This paper represents a review, exploring the potential applications of AI and blockchain in enhancing financial control systems, in particular, within AML compliance, focusing on key areas such as transaction monitoring, cross-institutional data sharing, and regulatory reporting. The integration of blockchain can streamline AML processes, reduce operational costs, and increase the effectiveness of detecting illicit financial activity. The combination of blockchain technologies and artificial intelligence algorithms in financial control is considered. It is shown how automation of transaction analysis can strengthen the stability of the banking system and prevent financial crimes. It is demonstrated that the convergence of Artificial Intelligence and blockchain technologies presents a transformative opportunity to strengthen AML frameworks, particularly in the face of rising crypto-enabled financial crimes. This research offers several important contributions to the academic literature. First, it presents a synthesis of the current status of artificial intelligence approaches used for compliance in detecting fraud in Bitcoin transactions. This review discusses the essential methodologies and tactics in a particular area that intersects finance and compliance but falls under the broader disciplines of AI-driven finance and decentralized finance (DeFi). The incorporation of AI into financial control marks a tremendous technological revolution that is affecting industries across the board. Second, the study assesses the current state of the publications, major trends, and research gaps, emphasizing areas that deserve additional investigation.
Bitcoin's security posture depends on more than consensus rules and proposal-based governance. This study proposes a formal cybersecurity framework for Bitcoin that integrates automated vulnerability monitoring, dependency inventory control, exploitability analysis, relational graph analytics, and funded bounty incentives. The framework is intended to reduce vulnerability exposure in Bitcoin Core and adjacent open-source dependencies through Dependabot for automated security pull requests, FOSSA for supply chain visibility, CycloneDX for exploitability classification, and Neo4j for relational tracking of vulnerability scope. The study argues that Bitcoin Improvement Proposals are insufficient for vulnerability management because they do not provide rapid remediation workflows or structured researcher incentives. A formal responsibility model is also proposed to assign accountability across maintainers, contributors, bounty hunters, financers, and policy functions. The resulting framework advances a more responsive, measurable, and auditable security posture for the Bitcoin ecosystem than existing frameworks.