High-quality smart contract auditing datasets are crucial for evaluating security tools and advancing smart contract security research. Two major limitations of existing datasets are the manual-induced scalability bottleneck and the deficiency in data granularity and diversity. To address these limitations, we propose GiANT, an automated framework designed to curate smart contract auditing datasets by distilling vulnerability insights from real-world auditing reports. GiANT employs a divide-and-conquer strategy coupled with the Chain-of-Thought technique to extract structured vulnerability information from Code4rena reports, followed by an LLM-as-a-judge mechanism to perform rigorous quality assurance. To evaluate GiANT's effectiveness, we run it on 388 real-world audit reports and generate the GiAnt Corpus comprising 7,711 vulnerability findings across five severity levels. Manual assessment of the dataset demonstrates exceptional reliability in information extraction, achieving a mean quality score of $4.76\pm0.37$ (out of 5) with inter-rater agreement $κ$ of 0.88. We further validate the practicality of our dataset by benchmarking 4 state-of-the-art LLMs on vulnerability detection, code summarization, mitigation recommendation, and automated gas optimization tasks, to establish performance baselines, thereby providing a valuable data foundation for future research in automated smart contract auditing.
Smart contract vulnerabilities in Decentralized Finance (DeFi) protocols resulted in over 1.49 billion USD in confirmed losses in 2024 alone, across 192 incidents [1]. As LLM-based vulnerability detection emerges as a promising approach to address these threats, the quality of evaluation datasets has become a critical bottleneck. Existing datasets suffer from three fundamental problems: they are built on outdated Solidity versions (e.g., v0.4) that no longer reflect modern DeFi contracts [5][6][7]; they rely on automated or LLM-generated annotations that introduce hallucination-driven label noise [9][10]; and they apply coarse single-layer labeling that fails to capture the semantic complexity of real-world business logic vulnerabilities [6][7][11][12]. We present Bastet, an expert-labeled DeFi smart contract vulnerability dataset that addresses all three problems through real-world audit findings (2021-2024), human expert annotation with discussion-based consensus, and a two-layer taxonomy of 46 Tags and 77 Subtags. Bastet comprises 4,402 findings collected from 394 Code4rena competitive audit reports spanning April 2021 to November 2024, of which 849 findings are fully annotated by white-hat security researchers from the DeFiHackLabs community. All annotations are produced through a two-annotator consensus workflow, ensuring label accuracy grounded in real-world vulnerability root causes.
Ethereum is a widely adopted blockchain platform that supports a large number of decentralized applications. Despite its rapid growth, Ethereum remains vulnerable to security threats, particularly phishing attacks that exploit transactional behavior. This study investigates the effectiveness of tree-based ensemble learning models for detecting phishing transactions on the Ethereum network using an imbalanced transaction dataset. Seven tree-based ensemble classifiers are empirically evaluated under a cost-sensitive learning framework, with performance assessed using the Matthews Correlation Coefficient (MCC) as the primary metric. The results show that boosting-based ensembles substantially outperform bagging-based approaches and a single decision tree. In particular, Gradient Boosting achieves the strongest detection performance with an MCC of 0.9742, while CatBoost provides a trade-off between detection performance and computational efficiency, achieving competitive detection accuracy with the lowest average inference time (approximately 1.54 µs per transaction). The findings demonstrate that accurate and robust phishing detection can be achieved using a compact feature representation, enabling practical deployment with reduced computational overhead.
Cryptocurrency fraud on blockchain platforms continues to cause substantial financial losses, creating an urgent need for detection systems that are not only accurate but also interpretable for operational and regulatory use. In this paper, we propose an explainable framework for Ethereum fraud detection integrating an XGBoost ensemble with TreeSHAP. This system achieves high predictive performance (96.3% F1-score, 96.6% recall) while providing model-level transparency via an interactive chatbot interface. Evaluation using fidelity and stability metrics confirms the reliability of the SHAP-based insights, while user-role simulations demonstrate that our structured delivery enhances clarity and actionability over standard visualizations. This work offers a practical, transparent foundation for deploying robust AI in high-risk financial environments without sacrificing accuracy.
Decentralized Finance (DeFi) has introduced new security challenges due to its open, permissionless, and pseudonymous nature, which has increased the risk of fraud and phishing activities. This thesis first presents a comprehensive study of 284 DeFi platforms to examine their architectural, functional, and security-related characteristics. Building on this ecosystem-level analysis, the thesis develops a behavior-centric multiclass detection framework using Ethereum transaction data. The framework integrates legitimate, fraud, and phishing activities into a unified dataset and evaluates several traditional and deep tabular learning models, including TabNet, GANDALF, and NODE. The results show that deep tabular models outperform conventional baselines, with NODE achieving the strongest overall performance. Feature importance analysis highlights gas usage, nonce behavior, transaction frequency, and wallet activity as key indicators of malicious behavior. Overall, this thesis demonstrates that behavior-based Ethereum transaction features combined with deep tabular learning can support more effective and scalable DeFi threat detection.
Abstract - Traditional machine learning-based fraud detection frameworks treat transaction registries as static, isolated, non-relational entities. While effective for simple localized pattern recognition, these methods are structurally blind to multi-hop relational dependencies, automated asset splitting, or continuous temporal dynamics characteristic of modern financial fraud within decentralized finance (DeFi) networks. This paper presents a complete structural paradigm utilizing Temporal Graph Neural Networks (TGNNs) to identify non-linear anomaly patterns directly in transaction graphs. By projecting raw financial data streams as dynamic, continuous-time directed graphs, our model learns evolving node and edge representations without relying on synthetic tabular oversampling mechanisms. Empirical simulation methodologies demonstrate that shifting the analytical paradigm from local, isolated classification to global temporal network topology minimizes false positives by 34.2% while significantly improving minority-class recall. Key Words: Credit Card Fraud, Graph Neural Networks, Temporal Embeddings, Class Imbalance, Deep Learning, Decentralized Finance (DeFi)
Pedro Henrique F. S. Oliveira, Heder S. Bernardino, Saulo Moraes Villela, Edelberto Franco Silva · 6 authors
O Ethereum é uma plataforma de criptomoedas que permite a execução de contratos inteligentes, programas autônomos que operam em uma rede descentralizada. As vulnerabilidades nesses contratos representam grandes riscos financeiros e de segurança nos ecossistemas blockchain, motivando a automatização do processo de detectá-las. Este trabalho estuda a detecção de vulnerabilidades em contratos inteligentes Ethereum usando embeddings derivados de bytecode. Embeddings são representações vetoriais geradas por modelos de linguagem, que capturam as características estruturais de texto. Essas representações foram usadas como entrada para os algoritmos de regressão logística, árvore de decisão e floresta aleatória, com o fim de detectar quais contratos possuem vulnerabilidades. Os resultados mostram que os embeddings contêm informações úteis para distinguir contratos vulneráveis de não vulneráveis. O estudo também constata que a alteração da distribuição original dos dados durante o treinamento afeta significativamente o desempenho, destacando a sensibilidade das abordagens baseadas em embeddings às estratégias de amostragem.
Federated Learning (FL) enables collaborative model training across decentralized data silos without raw data exchange, making it particularly attractive for privacy-sensitive domains like financial fraud detection. However, FL introduces critical vulnerabilities, notably the poisoning of global models through malicious client updates. Traditional defense mechanisms often rely on computationally expensive aggregation rules or complex anomaly detection. This paper introduces PoSFedFraud, a robust framework that integrates a Proof-of-Stake (PoS) economic layer directly into the federated aggregation process for financial fraud detection. By combining staking mechanisms with a dynamic reputation system, PoS-FedFraud economically disincentivizes adversarial behavior through automatic slashing and trust decay. We simulate a toy fraud detection scenario using a 29-dimensional feature space, demonstrating how the framework defends against norm-based gradient poisoning attacks. Our experimental results show that PoS-FedFraud successfully identifies and penalizes malicious actors—reducing their stake and trust upon detection—while maintaining global model convergence. The proposed method offers an incentive-compatible punitive layer that complements existing robust aggregation and anomaly-detection techniques for decentralized financial applications.
The burgeoning prevalence of Ethereum phishing behavior has iCSUR-2025-0155mposed substantial constraints on the advancement of blockchain finance, resulting in losses of more than $7.7 billion to date, so it is urgent to detect it in time. Currently, available detection methods usually focus on the spatial features within transaction graphs. These methods often employ shallow mining techniques on small samples. As a result, they may overlook certain aspects of interaction patterns, such as temporal behavior. Additionally, their data mining capability is limited due to the small sample sizes. In this study, we propose a graph contrastive learning framework to enrich features of accounts behavior patterns with restricted samples to overcome these limitations. Firstly, we construct an Ethereum interaction graph with the multi-graph involving more temporal information centered with labeled nodes and lighten it with our strategy. Secondly, to comprehensively characterize the accounts pattern, we design the encoder part with the GAT-LSTM model based on attention mechanism fusing statistical features , fine-grained temporal behavioral features and graph structural semantic features . Thirdly, to moderate the sparsity of phishing nodes, we employ data augmentation and contrastive learning to fully mine sparse node information. Moreover, we carried out an in-depth experimental evaluation. The CMD-EPD approach, boasting an F 1 -score of 0.87, outperformed all comparison methods. We also executed a thorough case study to analyze phishing accounts phenomenological indicators which back up the superiority of our framework.
Fraud detection on Ethereum is challenging because of the anonymity, speed and graph structure of blockchain transactions. While prior research has proven the effectiveness of using machine learning classifiers, Graph Neural Networks (GNNs) and behavioural heuristics to detect fraudulent transactions, most systems are offline and fail to consider real-world deployment challenges for real-time blockchain analytics. Here, we present DeTrust ETH, an operational fraud intelligence system for real-time tracking of Ethereum transactions on the Sepolia testnet. DeTrust ETH aims for the integration of five operational considerations: (1) real-time blockchain ingestion with Web3.py, (2) explainable machine learning with XGBoost and SHAP, (3) light-weight graph-based transaction tracing and risk propagation, (4) temporal trust decay and behavioural anomaly detection, and (5) tamper-resistant on-chain persistence of trust scores using Solidity smart contracts. The system maintains an in-memory directed transaction graph for real-time edge insertion and updating, circular-flow tracing, funding pattern tracing and fast path tracing, avoiding the retraining overhead of Graph Neural Networks (GNNs). Our experimental results demonstrate the median graph-query time is less than 20 ms, the system can handle 222.82 requests per second with a concurrent load, and 93.44% fraud recall with a recall-favouring threshold. Unlike prior research that mostly focuses on accuracy on historical data, DeTrust ETH focuses on real-time deployment. The novelty of this work lies in the design of a real-time, low-latency fraud intelligence architecture that integrates explainable machine learning, temporal trust modeling, and lightweight graph analytics under streaming blockchain constraints.
Blockchain-based financial systems process billions in transactions but remain vulnerable to sophisticated fraud schemes. Current detection approaches analyze completed transactions, preventing neither fund loss nor protocol exploitation. We address this through an oracle-mediated prevention system integrating machine learning inference with smart contract execution. Training ensemble models on 12,847 Ethereum transactions with engineered features capturing gas anomalies and temporal patterns, we achieve 94.2\% fraud classification accuracy. Testnet deployment demonstrates 1.09-second response latency with 6.8\% computational overhead, contrasting favorably against prior on-chain implementations requiring 34\% overhead. Our working prototype validates practical viability for production environments where security requirements justify marginal transaction costs.
Blockchain and decentralized finance have revolutionized the financial ecosystem while simultaneously exposing it to cryptocurrency phishing attacks. Existing phishing detection methods primarily rely on graph learning, but they face significant limitations. Static graph learning approaches fail to account for the temporal evolution of phishing patterns, while semi-dynamic methods, such as those combining static GNNs with LSTM, struggle to capture the irregular and bursty nature of blockchain transactions. Moreover, these methods overlook the diversity of Ethereum transactions, treating them as homogeneous graphs, and heavily rely on supervised learning, which requires extensive labeled data that is not readily available. These limitations reduce their adaptability to emerging phishing threats. In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities. PhishEye formulates Ethereum transactions as a heterogeneous temporal attributed multi-graph and incorporates a novel temporal graph contrastive learning model, which captures both temporal patterns and heterogeneous transaction types. The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods, achieving an F1 score of 87.23% and an AUC of 98.43% for phishing transaction detection, and an F1 score of 94.19% and an AUC of 98.03% for phishing account detection. In real-world deployment from May 1, 2023 to July 31, 2024, PhishEye identified 1,803 previously unknown phishing addresses, providing early alerts that helped prevent losses exceeding 2 billion USD.
To address the challenges of topological obscurity and extreme label sparsity in large-scale Ethereum transaction networks, a novel self-supervised phishing detection framework named Eth-GBAV is proposed, integrating graph attention, broad learning, and adversarial variational inference. The framework initiates with a biased random walk strategy guided by transaction intensity and temporal dynamics to capture the initial behavioral semantics of nodes. To distill discriminative features from noisy backgrounds, a “Generative-Attention” encoding architecture is constructed, where a graph attention network aggregates weighted structural neighborhoods and a Variational Autoencoder (VAE) characterizes the underlying probability distribution of legitimate transaction patterns. By maximizing the evidence lower bound, anomalous accounts are effectively isolated through reconstruction residuals. Furthermore, the broad learning system is introduced as an efficient analytical decision layer. By mapping VAE-derived latent embeddings and reconstruction errors into an expanded high-dimensional feature space, the framework captures intricate behavioral correlations via mapping and enhancement neurons. Extensive experimental verification on two large-scale datasets demonstrates the superior performance of Eth-GBAV. On the XBlock dataset, it achieves a leading F1-score of 0.9847 and a recall of 0.9839, outperforming the most competitive state-of-the-art model by significant margins. On the Kaggle dataset, the framework maintains high robustness with an accuracy of 0.9592 and an F1-score of 0.9069.
Financial fraud across cross-border payment systems and blockchain-based transaction networks has grown in scale, sophistication, and velocity, driven by increased digitization, regulatory fragmentation, and the pseudonymous nature of decentralized infrastructures.This study presents a comprehensive examination of AI-driven anomaly detection techniques designed to address these evolving threats.From a broad perspective, the paper reviews the global financial ecosystem, highlighting vulnerabilities in traditional correspondent banking frameworks and emerging decentralized finance (DeFi) architectures.It then narrows to advanced machine learning and deep learning approaches, including supervised, unsupervised, and hybrid models such as autoencoders, graph neural networks, and reinforcement learning systems for real-time fraud detection.Particular emphasis is placed on transaction pattern analysis, behavioral profiling, and network topology modeling to uncover hidden relationships and detect anomalous activities across distributed ledgers and cross-border payment rails.The study further evaluates challenges such as data sparsity, class imbalance, adversarial manipulation, privacy constraints, and regulatory compliance, including AML and KYC requirements.By integrating AI with blockchain analytics and financial monitoring systems, the paper demonstrates how adaptive, scalable, and explainable detection frameworks can significantly enhance fraud prevention capabilities.The findings provide strategic insights for financial institutions, regulators, and fintech developers aiming to strengthen global financial security.
Ethereum’s active financial ecosystem makes itself become a hotbed of phishing scams. Existing studies construct transaction subgraphs and employ GNNs to identify potential phishing accounts. However, existing detection methods rely on complete historical transaction data, making it difficult to detect scams at an early stage. To address this issue, we propose Ethereum Phishing Scams Early Detection (called EPED) method. First, we combine GCN and GRU to capture accounts’ local structural relations and the temporal evolution of their transactions. Second, we introduce deep reinforcement learning for adaptive optimization of the detection time. The two strategies jointly enable early detection with limited data. Experimental results demonstrate that by using only 4.6 days of transaction data, our method achieves a Recall 4.09% higher than existing methods that rely on the full dataset. This result demonstrates the method’s timeliness and effectiveness.
The rapid growth of decentralized finance on Ethereum has facilitated the rise of fraudulent Ponzi schemes, which exploit blockchain immutability and pseudonymity to deceive investors. Existing detection methods, often fail to generalize to evolving attack strategies, while current multimodal approaches suffer from high computational overhead. To address these challenges, we propose LightPonzi, a lightweight multimodal framework that integrates transaction graphs, abstract syntax trees, and textual semantics of smart contracts. By leveraging GraphSAGE and DistilBERT, LightPonzi efficiently encodes structural, behavioral, and semantic features, which are fused for accurate classification. Extensive experiments on a curated dataset of Ethereum contracts demonstrate that LightPonzi achieves a balanced F1 score of 0.911 while processing each contract in 80.11 ms on average, outperforming state-of-the-art baselines in both effectiveness and efficiency. Our framework provides a practical solution for real-time Ponzi scheme detection.
The rapid convergence of artificial intelligence and blockchain technologies has increased the demand for efficient and accurate methods to detect fraudulent behavior in smart contract–driven systems. Smart contracts automate digital transactions in decentralized environments, yet they remain vulnerable to fraud while operating under strict computational and scalability constraints. In this study, we propose an evolutionary-guided CNN compression framework tailored for Convolutional Neural Networks (CNNs) aimed at improving fraud detection in smart contract analysis while significantly reducing model complexity. The proposed approach uses evolutionary optimization to guide structured model compression, enabling the removal of redundant parameters without compromising predictive performance. Experimental evaluations demonstrate up to a 50% reduction in model parameters while maintaining 97.8–97.9% classification accuracy, making the resulting models suitable for deployment in resource-constrained environments. By combining evolutionary optimization with CNN-based fraud detection, this work provides an efficient and interpretable solution for smart contract analysis, supporting scalable and practical deployment in blockchain-related security applications.
As cross-chain interoperability advances, decentralized finance (DeFi) protocols enable illicit funds to be reorganized into uniform liquid assets that flow throughout the cryptocurrency market. Such operations can bypass monitoring targeted at individual blockchains and thereby weaken current regulatory frameworks. Motivated by these, we introduce UniDetect, a multi-chain cryptocurrency fraud account detection method based on large language models (LLMs). Specifically, we use domain knowledge to guide the LLM to generate general transaction summary texts applicable to heterogeneous blockchain accounts, which serve as evidence for fraud account detection. Furthermore, we introduce a two-stage alternating training strategy to continuously and dynamically enhance the multimodal joint reasoning for detecting fraudulent accounts based on both the textual evidence and the transaction graph patterns. Experiments on multiple blockchains show that UniDetect outperforms existing methods 5.57% to 7.58% in Kolmogorov-Smirnov (KS). For cross-chain zero-shot detection, UniDetect identifies over 94.58% of fraudulent accounts. It also generalizes well to non-blockchain data, delivering a 6.06% improvement in F1 over existing methods. The dataset and source code are available at https://github.com/msy0513/UniDetect.
This research explores how blockchain technology can support better fraud detection in modern financial systems. Financial institutions regularly encounter issues such as identity theft, unauthorized access, and manipulation of transaction records. As financial activities increasingly move to digital platforms, these risks have become more complex and difficult to manage. Many traditional financial systems rely on centralized databases and manual monitoring processes, which may delay the identification of suspicious activities and allow fraudulent transactions to occur before they are detected.Blockchain technology provides a possible solution to these challenges. It operates through a distributed ledger where transaction data are recorded across a network rather than stored in a single central system. Because the information is verified through cryptographic methods and shared among multiple participants, altering or manipulating financial records becomes extremely difficult. This structure allows financial institutions to track transactions more clearly and detect unusual patterns more quickly.In addition, blockchain creates a transparent and reliable record of financial activities, which improves auditing and strengthens accountability among network participants. By introducing decentralized verification and secure record keeping, blockchain systems can support real-time monitoring of financial operations. As a result, integrating blockchain into financial infrastructures may improve fraud detection, reduce financial risks, and increase trust among institutions and users
Fraudulent activities on blockchain networks threaten the integrity and reliability of decentralized finance ecosystems. Accurately identifying malicious nodes such as phishing or ransomware addresses, within large-scale blockchain transaction graphs remains a critical challenge due to their dynamic, sparse, and continuously evolving topologies. Transfer learning offers a powerful paradigm for fraud detection because many fraudulent schemes, including ransomware and phishing, are often orchestrated by overlapping actor groups that share behavioral and structural patterns across networks. Leveraging these shared representations enables knowledge transfer from previously observed fraud types to emerging ones. However, the complex and multi-modal nature of digital financial systems introduces substantial challenges for graph-based transfer learning. Fraudulent activities are shaped by diverse modalities including graph structure, transaction sequences, temporal price dynamics, and textual metadata, while distributional shifts frequently occur across time and platforms. Existing graph transfer learning methods struggle to model such multi-modal dependencies and to align divergent feature distributions. To tackle these challenges, we develop a Multi-mOdal Enhanced Graph Transfer Learning (MOE-GTL) framework which incorporates graph, temporal, and textual modalities for fraudulent node detection. We further introduce Temporal-aware Maximum Mean Discrepancy (TMMD), a regularization mechanism that explicitly aligns multi-modal feature distributions between source and target graphs over time. Extensive experiments reveal that our MOE-GTL model notably improves the accuracy of fraudulent node classifications on Ethereum and Solana transaction graphs.
Against the complex characteristics of the Ethereum transaction network and the limitations of existing graph embedding methods based on random walks, which fail to effectively capture transaction temporal dynamics and the flow of funds, we propose a fraud detection algorithm for Ethereum, ETX2Vec (Ethereum Transactions (TX) to Vector), which improves upon transaction subgraph construction and random walk strategies. First, in terms of transaction subgraph construction, we extract the first-order predecessor and successor neighboring nodes of the target node to reconstruct the transaction subgraph, enabling the random walk to effectively capture the complete flow of funds. Second, in the design of the random walk strategy, we introduce two key improvements: (1) the next node is selected based on the non-decreasing principle of transaction timestamps, effectively capturing the temporal dynamics of transactions within the network, and (2) a biased random walk strategy is designed based on both transaction timestamps and amounts, with a parameter α introduced to control the weighting of these factors when calculating transition probabilities. Experimental results show that ETX2Vec achieves an average performance of 96.04% in downstream node classification tasks, outperforming the best model in similar studies by 3.74%, and even surpassing neural network models such as GAT and GCN. This demonstrates that ETX2Vec is more effective at understanding and processing the Ethereum transaction network, leading to the learning of high-quality node embedding vectors.