Mingshun Ye, Dezhi Han, Chin‐Chen Chang, Mingdong Tang · 6 authors
The rapidly expanding Ethereum ecosystem has driven the flourishing of decentralized applications, but has also brought increasingly severe security risks. Ponzi scheme, in particular, pose a grave threat to platform security and user assets by luring investors with promises of high returns. The current detection methods generally suffer from limitations such as insufficient feature extraction, reliance on a single information source, and poor robustness. To address these challenges, this paper proposes a novel Multi-View Multi-Modal Fusion Framework with Large Language Models for Ponzi scheme detection on Ethereum, named MF2LLM. We first model the contract opcode sequence as an opcode chain graph and design a Time-Stamped Graph Encoder (TS-GE) to capture local temporal dependencies and execution flow relationships between opcodes. Concurrently, we construct an opcode semantic hypergraph based on semantic categories and design a Semantic-Weighted Hypergraph Encoder (SW-HGE) to model higher-order co-occurrence patterns and global associative features. Furthermore, we propose the Opcode Sequence Lightweighting (OSL) method, which significantly compresses the length of opcode sequences while preserving core control logic and semantic information. This provides high-quality structured input for information fusion. To this end, we perform multi-modal instruction fusion on multi-source heterogeneous features and employ LoRA to fine-tune LLMs. This enables the model to achieve cross-modal semantic reasoning and behavioural pattern recognition. Through extensive experimental validation on real-world datasets, MF2LLM demonstrates stable and superior detection performance even under conditions of highly imbalanced sample distributions. Compared to existing state-of-the-art approaches, our method outperforms across all metrics, achieving an ACC of 99.43%, Precision of 96.57%, Recall of 97.06%, and an F1-score of 96.81%. The efficiency and practical value of MF2LLM in detecting Ponzi schemes on Ethereum contribute to enhanced security for the decentralized application ecosystem. The codes are publicly available on Github: https://github.com/yemisua/MF2LLM.
Deepfake technology poses a growing threat to digital trust across journalism, law, and politics. Current CNN-based detectors capture local artifacts but struggle with high-quality fakes and offer no way to prove their predictions are genuine. This paper presents DeepTrust, a framework combining a hybrid CNN–Transformer detector with Zero-Knowledge Proof (ZKP) verification and blockchain-based record-keeping. The detection model fuses spatial features from an attention-enhanced Xception network, global context from ViT-B/16, and spectral cues from a Frequency Encoder through a cross-attention mechanism. Predictions are cryptographically committed using a Pedersen scheme with the Fiat-Shamir heuristic, then stored on a proof-of-work blockchain. Evaluated on FaceForensics++, Celeb-DF, DFD, and 140K Real vs Fake, DeepTrust achieves 97.00% accuracy and 0.999 AUC on FaceForensics++, with balanced per-class accuracy despite imbalance ratios up to 1:8.5. ZKP overhead remains below one millisecond per prediction.
Open access
Adversarial Robustness in Machine Learning
Generative Adversarial Networks and Image Synthesis
Social media platforms such as X (formerly Twitter) increasingly shape attention formation, market visibility, and value signaling in electronic commerce, particularly in emerging digital asset markets such as Non-Fungible Tokens (NFTs). Prior work shows that social engagement correlates with NFT prices, suggesting its potential for valuation support. However, open social platforms exhibit heterogeneous user credibility, automated activity, and coordinated promotion, which can distort engagement-based inference. To address these challenges, we propose NFT-TRUST, a trust-aware social signal modeling framework that transforms raw engagement into credibility- and integrity-aware indicators for robust valuation support under manipulation-prone conditions. The framework integrates three components: (i) Credibility-Weighted Social Signal Aggregation (CW-SSA), (ii) Engagement Disproportionality Detection (EDD), and (iii) Integrity-Aware Signal Attenuation (IASA), which jointly reduce the influence of unreliable or manipulated signals while preserving informative engagement. Rather than estimating intrinsic NFT value from social signals alone, NFT-TRUST evaluates the reliability of social attention and converts it into trust-aware features. An XGBoost-based model is used to capture non-linear interactions among these features. Robustness is assessed through stress testing with RL-TweetGen-ST, a reinforcement learning–based synthetic tweet generator that simulates controlled engagement inflation. Experimental results show that NFT-TRUST achieves competitive predictive performance while demonstrating improved stability under simulated manipulation. Ablation analysis indicates that credibility and integrity components are complementary and jointly enhance the reliability of social-signal-based inference. Overall, this work advances trust-aware analytics in electronic commerce and supports more reliable social-driven valuation in emerging digital markets.
Part II, 'How Decentralised Security is Organised,’ examines the actors, infrastructures, and incentives that shape security practices in Web3—from the structural insecurity of digital infrastructure to the emergent role of white hat hackers and collaborative security initiatives they coordinate. This chapter introduces a new protagonist in the security landscape: the blockchain white hat hacker. Far from operating in the shadows, this actors play a vital role in the moral, political, and economic landscape of blockchains by helping to safeguard decentralised systems. This chapter examines the practices, motivations and incentives—both financial, moral, and reputational—that drive white hat activity, highlighting how these individuals contribute to vulnerability disclosure, incident response and the overall resilience of the blockchain ecosystem. In doing so, it situates white hats not as central figures in the evolving ecosystem of decentralised security governance.
Blockchain and decentralized finance have revolutionized the financial ecosystem while simultaneously exposing it to cryptocurrency phishing attacks. Existing phishing detection methods primarily rely on graph learning, but they face significant limitations. Static graph learning approaches fail to account for the temporal evolution of phishing patterns, while semi-dynamic methods, such as those combining static GNNs with LSTM, struggle to capture the irregular and bursty nature of blockchain transactions. Moreover, these methods overlook the diversity of Ethereum transactions, treating them as homogeneous graphs, and heavily rely on supervised learning, which requires extensive labeled data that is not readily available. These limitations reduce their adaptability to emerging phishing threats. In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities. PhishEye formulates Ethereum transactions as a heterogeneous temporal attributed multi-graph and incorporates a novel temporal graph contrastive learning model, which captures both temporal patterns and heterogeneous transaction types. The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods, achieving an F1 score of 87.23% and an AUC of 98.43% for phishing transaction detection, and an F1 score of 94.19% and an AUC of 98.03% for phishing account detection. In real-world deployment from May 1, 2023 to July 31, 2024, PhishEye identified 1,803 previously unknown phishing addresses, providing early alerts that helped prevent losses exceeding 2 billion USD.
Lalithambikai S, R Kavinkumar, Sowndariya K, Barath M · 5 authors
While digital shifts have radically redefined modern governance and civil operations, the practice of casting ballots electronically continues to grapple with persistent obstacles concerning data transparency and operational robustness. Conventional, centralized digital voting systems typically harbor singular vulnerability points that attract cyber offensives, compounded by a distinct lack of mechanisms to rapidly manage arising voter concerns. In response to these pressing flaws, this study introduces a multifaceted architecture merging distributed ledger technologies with an intelligent, machine-learning-driven grievance resolution interface. Specifically, our model leverages a decentralised blockchain framework for immutable ballot storage, ensuring that individual vote modifications are virtually impossible and establishing a trustless verification environment devoid of centralized oversight. This schematic aims to seamlessly preserve data fidelity and supreme voter anonymity. Our comprehensive investigation of these distributed consensus rules and AI-guided triage methods indicates that unifying rigid cryptographic ballot handling together with responsive, automated complaint mechanisms dramatically elevates overall electoral resilience while reinforcing public faith in democratic workflows.
To address the challenges of topological obscurity and extreme label sparsity in large-scale Ethereum transaction networks, a novel self-supervised phishing detection framework named Eth-GBAV is proposed, integrating graph attention, broad learning, and adversarial variational inference. The framework initiates with a biased random walk strategy guided by transaction intensity and temporal dynamics to capture the initial behavioral semantics of nodes. To distill discriminative features from noisy backgrounds, a “Generative-Attention” encoding architecture is constructed, where a graph attention network aggregates weighted structural neighborhoods and a Variational Autoencoder (VAE) characterizes the underlying probability distribution of legitimate transaction patterns. By maximizing the evidence lower bound, anomalous accounts are effectively isolated through reconstruction residuals. Furthermore, the broad learning system is introduced as an efficient analytical decision layer. By mapping VAE-derived latent embeddings and reconstruction errors into an expanded high-dimensional feature space, the framework captures intricate behavioral correlations via mapping and enhancement neurons. Extensive experimental verification on two large-scale datasets demonstrates the superior performance of Eth-GBAV. On the XBlock dataset, it achieves a leading F1-score of 0.9847 and a recall of 0.9839, outperforming the most competitive state-of-the-art model by significant margins. On the Kaggle dataset, the framework maintains high robustness with an accuracy of 0.9592 and an F1-score of 0.9069.
Phishing attacks pose a significant security issue in Ethereum-based blockchain systems. Existing solutions, like TEGDetector, address these attacks by analysing how transactions evolve over time using Transaction Evolution Graphs (TEGs) constructed via time slicing, followed by a dynamic graph classifier that captures both spatial structure and temporal evolution with learned time coefficients. However, building and managing these graphs across multiple stages makes the overall approach complex and difficult to implement. In this work, we propose E2E-EmbedDetector, a lightweight end-to-end neural classification model that works directly with raw transaction data. The model learns embedding representations for important entities such as From, To, and ContractAddress, and also used two additional numeric features: transactional value and a derived input length. We train and evaluate the model on a balanced dataset of 50,000 Ethereum transaction using an 80/20 stratified split. The model achieves an accuracy of 95.63%, precision of 0.9265, recall of 0.9912, an F1 score of 0.9578, a ROC-AUC score of 0.9915 and a PR-AUC score of 0.9909. These results show that strong phishing can be achieved using a simpler and more practical tabular approach, without relying on complex temporal graph- based networks.
Ethereum’s active financial ecosystem makes itself become a hotbed of phishing scams. Existing studies construct transaction subgraphs and employ GNNs to identify potential phishing accounts. However, existing detection methods rely on complete historical transaction data, making it difficult to detect scams at an early stage. To address this issue, we propose Ethereum Phishing Scams Early Detection (called EPED) method. First, we combine GCN and GRU to capture accounts’ local structural relations and the temporal evolution of their transactions. Second, we introduce deep reinforcement learning for adaptive optimization of the detection time. The two strategies jointly enable early detection with limited data. Experimental results demonstrate that by using only 4.6 days of transaction data, our method achieves a Recall 4.09% higher than existing methods that rely on the full dataset. This result demonstrates the method’s timeliness and effectiveness.
Integrating blockchain into the Industrial Internet of Things (IIoT) has emerged as a promising solution for preserving data privacy and ensuring IoT security. Among various blockchain platforms, Ethereum stands out due to its support for smart contracts and its interoperability with lightweight communication protocols. Despite these advantages, particularly within Ethereum-based networks, IIoT systems remain vulnerable to large-scale threats such as Sybil attacks. These attacks pose a critical security risk because an adversary generates numerous fake entities to infiltrate and compromise the network, ultimately undermining its integrity and availability. Existing approaches utilize Ethereum smart contracts and lightweight protocols such as MQTT to secure IIoT communications, but often overlook sophisticated threats such as Sybil attacks, which introduce fraudulent nodes into the network. Conventional detection methods typically depend on centralized monitoring, undermining scalability and privacy, and there remains a lack of publicly available datasets representing adversarial behaviors in IIoT environments. In this paper, an Ethereum-based IIoT network is first developed, and a publicly available dataset is released through the GitHub repository. An advanced method is then proposed to detect and prevent Sybil attacks in a PoA-based IIoT network using decentralized federated learning. During the detection phase, a convolutional neural network (CNN) is employed within the decentralized federated learning framework, achieving an average detection accuracy and recall of 91.13% and 91.37% among clients, respectively. In the prevention phase, a secure smart contract is designed to manage a dynamic reputation system, effectively preventing Sybil nodes from remaining active on the network.
Bitcoin is one of the most widely used cryptocurrencies. It offers decentralization, transparency, and Pseudonymity. However, this leads to money laundering, illegal activities, and financial scams. Malicious users also try to bypass transparency by using third party mixing services to conceal origins of users and due to the vast number of transactions it becomes difficult to detect the ownership of bitcoin wallets. To address these challenges, profiling ownership of the bitcoin addresses becomes necessary. The proposed research compares traditional clustering techniques with transaction pattern analysis to identify which wallet addresses belong to which entities. Gini Impurity measure is used to evaluate how accurately the clusters are developed to detect ownership. Uncovering the relationship between these addresses is necessary to understand the behavior of users. This helps in identifying suspicious activities in the bitcoin network by mapping relations between the wallet addresses. This could aid in Anti-money laundering as a tool for crypto-forensics.
This review explores the application of machine learning techniques for fraud detection and prevention in the Ethereum blockchain. As a leading platform for decentralized applications (dApps), Ethereum is vulnerable to fraudulent activities such as scams, hacking attempts, and malicious transactions. This paper provides a comprehensive analysis of machine learning models used to predict, detect, and mitigate fraudulent behavior within the Ethereum ecosystem. By overviewing various machine learning methods, this study identifies the most effective approaches for addressing different types of vulnerabilities while offering a thorough review of existing research, key challenges, and limitations. It also examines the datasets and feature engineering techniques applied in this domain, outlining future directions and potential strategies for improving fraud detection. While machine learning has enhanced Ethereum’s security, challenges such as data availability, adversarial attacks, and model interpretability remain significant concerns. To address these gaps, this study highlights the potential of integrating deep learning architectures, graph representations, and hybrid models that combine supervised and unsupervised learning. Additionally, it explores the use of active learning and genetic programming to further enhance fraud detection capabilities. Furthermore, leveraging AI, particularly through large language models, could improve interpretability at the account, block, or transaction level, offering a clearer, more comprehensive view of fraudulent behavior across the Ethereum network. By tackling these challenges, future advancements in machine learning could further strengthen the resilience, security, and trustworthiness of Ethereum’s infrastructure.
D. Sravanthi, O. Shanmukha Hari Prasad, J. Srinath Reddy, A. Chiru Vardhan Reddy
The uncontrolled propagation of fake news on the digital frontiers continues to undermine the confidence of the populace, disorganizing supply chains and misled decision making on high stake regions. The existing fake news detectors are all largely text-based and are driven by machine learning or deep learning and do not pay much focus to integrity, provenance, and post-hoc verifiability of the model predictions. Moreover, the current procedures are usually trained and tested in controlled settings and do not facilitate adversarial manipulation of content and metadata, and are rarely provided to produce audit trails which cannot be modified by auditors of identified artifacts. It is in this respect that this paper introduces DeepTrustChain, a blockchain anchored hybrid deep learning framework in the detection of high-integrity fake news. The proposed system uses an encoder of text a transformer encoder with a Bidirectional recurrent module and an ensemble stacking layer to improve the robustness and generalization owing to the recent discoveries on stacking and ensemble methods of identifying fake news, and reliability-based methods of evaluation. At the same time, DeepTrustChain computes a trust score that represents a combination of model confidence and source level and propagation level features and anchors the prediction and proof on an authorized blockchain. Such a design provides verifiable, immutable records of the histories of the detection results and enables the decentralized checking of the news items by time. The conceptual evaluation of the framework in respect to multilingual and low resource states and can also leverage advancements in sequence modeling and representation learning in other applications such as music and affective computing. The key feature of DeepTrustChain is that it is an architecture that integrates integrity conscious hybrid deep learning with blockchain based anchoring, so that simultaneously achieves the high degree of detection accuracy, resistance to decision manipulation, and ultimate traceability of decision making regarding fake news.
Zeta Avarikioti, Ray Neiheiser, Krzysztof Pietrzak, Michelle Yeo
Over the last years, Ethereum has evolved into a public platform that safeguards the savings of hundreds of millions of people and secures more than $650 billion in assets, placing it among the top 25 stock exchanges worldwide in market capitalization, ahead of Singapore, Mexico, and Thailand. As such, the performance and security of the Ethereum blockchain are not only of theoretical interest, but also carry significant global economic implications. At the time of writing, the Ethereum platform is collectively secured by almost one million validators highlighting its decentralized nature and underlining its economic security guarantees. However, due to this large validator set, the protocol takes around 15 minutes to finalize a block which is prohibitively slow for many real world applications. This delay is largely driven by the cost of aggregating and disseminating signatures across a validator set of this scale. Furthermore, as we show in this paper, the existing protocol that is used to aggregate and disseminate the signatures has several shortcomings that can be exploited by adversaries to shift stake proportion from honest to adversarial nodes. In this paper, we introduce Wonderboom, the first million scale aggregation protocol that can efficiently aggregate the signatures of millions of validators in a single Ethereum slot (x32 faster) while offering higher security guarantees than the state of the art protocol used in Ethereum. Furthermore, to evaluate Wonderboom, we implement the first simulation tool that can simulate such a protocol on the million scale and show that even in the worst case Wonderboom can aggregate and verify more than 2 million signatures within a single Ethereum slot.
Weihong Wang, Yana Dimova, Victor Vansteenkiste, Tom Van Goethem · 5 authors
Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures and provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem.
Blockchain technology and cryptocurrencies have attracted significant attention in recent years, yet remain susceptible to cyber threats such as phishing attacks. Existing detection approaches often suffer from high computational costs and limited robustness, especially when facing varying data distributions and sparse structures. To address these issues, we propose Robust, Node behavior, Transaction structure, and Network (R-NTN), a detection framework for Ethereum phishing accounts that leverages multi-dimensional transaction features. R-NTN first constructs 2-hop ego graphs via random walks, then extracts features from three complementary dimensions: behavioral attributes, transaction-based structural features, and network embeddings. These features are integrated into a unified representation for downstream classification. Experiments show that R-NTN consistently outperforms baseline methods and maintains high accuracy across datasets of different scales and compositions, demonstrating strong robustness and generalizability.
Evidence management comes with requirements of a visibly secure, immutable, and scalable system to drive legal proceedings with ethicacy. Where research on fully on-chain solutions shows unrealistic and extravagant costs and performance limits, the traditional off-chain centralized storage systems exhibit an insecure environment, poor traceability, and tampering concerns. ChainSEAL is a hybrid Blockchain - IPFS-based forensic Evidence Management platform that integrates IPFS for encrypted Evidence file storage, blockchain as a distributed ledger for File hash and metadata, while off-chain storage for key management. The methodology explains the system flow, that as the evidence is submitted, the FIR is generated, the case request is created, and the evidence cycle is initiated. The cycle starts with fetching the SHA-256 of the file, then encrypting the evidence, submitting it on IPFS, fetching the Content Identifier (CID) of the file on IPFS, uploading the CID + File Hash + Metadata on-chain with a maintained verifiable Chain of Custody of the Evidence cycle. This ensures confidentiality and immutability of the system. The proposed framework is empirically evaluated for cost, storage efficiency, latency, and tamper-proofness. Its legal admissibility is established through an analysis of immutability, chain of custody integrity, and role-based access control.