This paper presents an empirical investigation of textual and semantic cues for fake news detection using FAKES-XL, a multi-domain, multi-language benchmark with leak-proof splits. Current reports often conflate gains with source/topic leakage and rarely assess probability calibration, limiting deployability across sources and languages. The present study trained text-only, semantic-only, and fused models on five bundles spanning English, Spanish, German, Hindi, and Italian, with temporal/source-grouped, topic-disjoint, cross-lingual zero-shot, and entity-disjoint evaluations. The methodology incorporated precommitted textual features (n-grams, stylometry, readability) and semantic signals (contextual embeddings, discourse, knowledge and retrieval-based evidence), applied post-hoc calibration, and quantified uncertainty via stratified bootstrap. Outcomes included Macro F1, Area Under the Receiver Operating Characteristic (AUROC), Area Under the Precision-Recall Curve (AUPRC), and Expected Calibration Error (ECE), with per-source and per-language scorecards and latency profiling under deployment constraints ($<=50 ~\text{ms}$on GPU;$<=120 ~\text{ms}$on CPU). While numeric results are not reported here, the analysis quantified the marginal value of each cue family, ablated discourse/knowledge/retrieval components, and produced calibrated thresholds tuned on validation and frozen on test. The contributions are a controlled comparison under strict leakage guards and a calibration-first evaluation that informs threshold selection. These findings support practical moderation workflows by offering reproducible scorecards and deployment-ready operating points.
Seyed Ahmadreza Abtahi, Reza Abtahi, Bruno Rodrigues, B. Stiller
This demo paper presents DappTweet, a Web3 app that lets any blockchain address send posts and direct messages on Twitter/X via a MetaMask wallet using an addressproven posting workflow. A relay account publishes on the user’s behalf and embeds the sender’s address and the transaction hash for public verification. The prototype implements three flows: public post, private message, and verification.
Cryptocurrencies are increasingly the subject of fake news, increasing risks for market stability and investor decisions. To address this issue, we propose a multimodal framework to detect fake cryptocurrency news using text, image, and sentiment features with BERT, Swin Transformer, and RoBERTa, respectively. We use multi-head attention to combine these features to ensure the complementarity of features from different modalities. The fused representations are passed into a fully connected layer for final classification. Experimental results show that this framework achieves better accuracy and reliability than unimodal and multimodal models for detecting cryptocurrency misinformation.
Existing Ethereum phishing scam detection methods based on graph neural networks focus on subgraph sampling while ignoring the global structure of the transaction network. When applied to graph structures, the sequence length of Transformers grows exponentially with the number of hops, leading to convergence issues for Transformer-based methods when applied to large-scale Ethereum data. To address these issues, this paper proposes a global graph transformer for Ethereum account detection, (GGTEAD). GGTEAD integrates node global attention extracted via dimensionality reduction algorithms with node local attention to strengthen transactional relationships between nodes. By introducing effective edge weighting strategies and anomaly scoring mechanisms, it significantly enhances detection capabilities for minority phishing accounts. This addresses the challenge of poor detection performance for phishing scam accounts within large-scale, heterogeneous Ethereum networks, providing valuable insights for IoT-blockchain integrated environments. The experimental findings, derived from two authentic Ethereum datasets (MulDiGraph and B4E) demonstrate that GGTEAD attains F1 scores of 84.36% and 71.22%, respectively, signifying enhancements of 5.53% and 2.88% over the prevailing state-of-the-art methods ScamSweeper and Bert4eth.
Security and user experience are critical priorities in modern banking, yet traditional authentication practicessuch as passwords and one-time passwords (OTPs)-remain vulnerable to phishing, credential theft, and data breaches. This research explores the integration of blockchain-based authentication, specifically using MetaMask for passwordless login, as a secure alternative for digital banking systems. The proposed approach eliminates centralized credential storage by leveraging cryptographic signatures and client-side verification, thereby enhancing both security and user privacy. A prototype banking application was developed and evaluated, demonstrating a 50 % reduction in authentication time and improved resistance to phishing attacks. The study further analyzes decentralized identity management's implications for regulatory compliance, including GDPR and KYC alignment. By comparing conventional and Web3 authentication systems, this work illustrates how decentralized login mechanisms can significantly strengthen banking security, streamline user interaction, and promote a transparent, customer-centric digital banking ecosystem.
The prosperity of Ethereum gives rise to a new type of transaction-based phishing scam. Specifically, users are tempted to visit phishing websites and sign phishing transactions that allow scammers to withdraw their tokens. Meanwhile, to accelerate the deployment of phishing websites, scammers have introduced a business model, Drainer-as-a-Service (DaaS). In this model, drainer operators focus on crafting specialized phishing toolkits, named ''wallet drainers'', while drainer affiliates handle the deployment and promotion of phishing websites. After stealing victims' tokens, they will distribute profits. In this paper, we present the first systematic study of DaaS on Ethereum. To begin with, we propose a snowball sampling approach to build the first large-scale DaaS dataset, including 1,910 profit sharing contracts, 56 operator accounts, 6,087 affiliate accounts, and 87,077 profit-sharing transactions. Then, we analyze the scale of DaaS from the perspectives of victims, operators, and affiliates, and perform clustering analysis to uncover dominant DaaS families. Finally, we reported DaaS accounts in the dataset and 32,819 phishing websites deployed with DaaS toolkits to the community. Our work aims to serve as a guide for Ethereum service providers to enhance user protection against DaaS.
Luis de‐Marcos, Adrián Domínguez‐Díaz, Javier Junquera-Sánchez, Carlos Cilleruelo · 5 authors
The Dark Web, a hidden segment of the internet, has become a hub for illicit activities, facilitated by various forms of digital identification (IDs) such as email addresses, Telegram accounts, and cryptocurrency wallets. This study conducts a comprehensive analysis of the Dark Web’s identification and communication patterns, focusing on the roles of different ID types and their associated activities. Using a dataset of Dark Web documents, we construct and analyze a bipartite network to model the relationships between IDs and web documents, employing graph–theoretical metrics such as degree centrality, closeness centrality, betweenness centrality, and k-core decomposition, while analyzing subnetworks formed by ID type. Our findings reveal that Telegram forms the backbone of the network, serving as the primary communication tool for hacking-related activities, particularly within Russian-speaking communities. In contrast, email plays a more decentralized role, facilitating finance–crypto and other activities but with a high level of fragmentation and English as the predominant language. XMR (Monero) wallets emerge as a key component in financial transactions, forming a cohesive subnetwork focused on cryptocurrency-related activities. The analysis also highlights the modular and hierarchical nature of the Dark Web, with distinct clusters for hacking, finance–crypto, and drugs–narcotics, often operating independently but with some cross-topic interactions. This study provides a foundation for understanding the Dark Web’s structure and dynamics, offering insights that can inform strategies for monitoring and mitigating its risks.
Phishing attacks in Web3 ecosystems are increasingly sophisticated, exploiting deceptive contract logic, malicious frontend scripts, and token approval patterns. We present DeepTx, a real-time transaction analysis system that detects such threats before user confirmation. DeepTx simulates pending transactions, extracts behavior, context, and UI features, and uses multiple large language models (LLMs) to reason about transaction intent. A consensus mechanism with self-reflection ensures robust and explainable decisions. Evaluated on our phishing dataset, DeepTx achieves high precision and recall (demo video: https://youtu.be/4OfK9KCEXUM).
A blockchain-enabled Model integrates blockchain technology with Intrusion Detection Systems to enhance the security of Internet of Things (IoT) networks. It ensures data integrity, decentralization, and tamper-proof logging of intrusion detection. The approach improves trust, transparency, and real-time threat detection in distributed IoT environments. The existing blockchain-based IDS approaches, Blockchain Enabled (BCE-IoT), uniquely integrate blockchain consensus with federated-style local training, lightweight cryptography, and Shapley Additive Explanations (SHAP)-based explainability, ensuring both security and interpretability in IoT environments. The proposed work combines Blockchain technology with explainable artificial intelligence solutions to create a new cybersecurity Model that strengthens intrusion detection within IoT networks. The proposed model enhances transparency in tracking cyberattacks by combining blockchain security storage capabilities with SHAP, an explainable AI. This research utilises machine learning and artificial intelligence to detect threats in real-time, countering Distributed Denial of Service (DDoS), Denial of Service (DoS), scanning, Cross-Site Scripting (XSS), injection, password, and backdoor attacks. BCE-IoT delivers more precise security by combining blockchain’s permanent data features and AI anomaly detectors, thereby reducing security alert mistakes. The performance effectiveness of Blockchain-Enabled IoT surpasses that of the Content Integrity Detection System. It combines Blockchain and Software-Defined Networking to enhance security in network environments, utilising blockchain-based mutual confirmation for software-defined networking to detect and block cyber threats. The evaluation establishes BCE-IoT as an effective IoT network security solution that delivers strong cybersecurity features, is adaptable to modern connected environments, and offers interpretable security solutions. The performance evaluations demonstrate that BCE-IoT provides a robust, flexible, and interpretable cybersecurity solution suitable for modern IoT environments.
S.Y. Wang, Laurence T. Yang, Xianjun Deng, Cannian Zou · 7 authors
As a key infrastructure for social fintech ecosystems, ethereum enables decentralized finance (DeFi) applications where security issues directly compromise ecosystem stability. Among critical security concerns, ethereum phishing scams stand as typical scams. Criminals employ distinctive fund transfer patterns (e.g., money laundering stages: placement, layering, and integration) to obscure illicit funds through long transaction paths. While graph neural networks (GNNs) dominate detection methods, they fail to model these long paths effectively. To address this, we propose the first framework to detect phishing scams through explicitly modeling fund transfer patterns. Our novel method, IMPUTATION, introduces: 1) a heuristic fund transfer path graph construction method utilizing iterative transaction pairing to capture complicated fund transfer patterns; 2) role-topology account embeddings encoding fund transfer patterns; 3) attention fusion leveraging initial transactions to suppress path noise; and 4) heterogeneous correlation graphs with weighted adjacency reconstruction modeling interpath dependencies. Extensive experiments demonstrate that IMPUTATION outperforms on all five metrics and detecting Ethereum phishing scams from fund transfer patterns is effective.
Blockchain technology enables semi-anonymous transactions, where user identities are not directly revealed but instead linked to cryptographic wallet addresses. While this design enhances privacy and security, the intrinsic transparency of public blockchains raises concerns about the true anonymity of users. To address this, privacy-enhancing techniques such as CoinJoin were developed to obscure transaction flows. CoinJoin is a Bitcoin-based mixing technique that combines multiple inputs and outputs into a single larger transaction, making it difficult to trace the original senders and recipients. Although CoinJoin was intended to support privacy-preserving transactions, it is often exploited for money laundering. As a result, there is a growing need to identify CoinJoin transactions in order to prevent such misuse. This research aims to detect unidentified CoinJoin transactions on the Bitcoin blockchain using a machine learning approach. Unlike prior work that relied on heuristics or traditional machine learning algorithms, we propose an improved methodology relying on random forest ($\mathbf{R F}$) models designed to handle imbalanced datasets. Specifically, we introduce a novel variant, the biased random forest (BRAF), aimed at improving detection performance under significant class imbalance.
Online review systems play a critical role in shaping consumer decisions and business reputation. However, they are increasingly vulnerable to manipulation, particularly through a coordinated practice known as review bombing. This occurs when large numbers of negative reviews are posted in a short time frame, often driven by political or ideological motives rather than genuine user experience. Such attacks distort public perception and can cause significant economic harm, particularly to small and medium-sized businesses. This paper presents a decentralized review platform architecture designed to enhance fairness, transparency, and resistance to manipulation. The system leverages Blockchain (BC) technology to enforce a one-NFT-one-review policy, in which each review is linked to a unique Non-Fungible Token (NFT) representing the user’s right to post. To ensure real-world authenticity, the platform incorporates a Proof-of-Visit mechanism using timelimited QR codes displayed on-site. Only users who scan the QR code at a physical location are authorized to mint the NFT. A prototype was implemented using CosmJS, CW721 smart contracts, and Keplr wallet integration, and deployed on the Neutron testnet. Empirical evaluation shows that the total cost for a complete review submission-including NFT minting and review posting-is approximately 0.012845 NTRN ($\approx$ ${\$}$ 0.00257${\$}$ USD), confirming the system’s economic feasibility. By addressing both the social dynamics of review bombing and the technical limitations of centralized platforms, this study proposes a scalable and cost-effective BC-based architecture for secure, verifiable, and tamper-resistant online review systems.
Tanmay Thapliyal, Aman Gupta, Rachit Agarwal, Sandeep K. Shukla
The emergence of Blockchain 2.0, along with the introduction of smart contracts (SCs), has facilitated the development of automated decentralized financial interactions on various platforms. These programmable contracts are utilized in applications including decentralized finance (DeFi), token issuance, and automated fund transfers. However, the pseudonymous nature of blockchain transactions, combined with automation capabilities and mixing services, has been exploited by malicious actors to launder illicit proceeds. Most of the techniques in the state-of-theart approaches detect addresses related to such illicit actors by relying on machine learning techniques that use only transactionbased features. In this work, we propose an algorithm to detect and identify addresses that are related to scamming activities, such as phishing. We focus on Ethereum, one of the widely adopted blockchains, and analyze over 1.8 billion transactions to identify SC deployments, thereby creating an SC deployment mapping. Alongside this mapping, we construct a transaction graph of known scam-related accounts, which we use to identify accounts involved in laundering proceeds from these scams. This approach identifies $\mathbf{3 2, 2 7 2}$ accounts associated with known scam addresses. The proposed algorithm takes an average of 0.024 seconds to determine whether an address is illicit. We also identify three recurring motifs characteristic of scam-related addresses, which can aid blockchain forensic frameworks in detecting such activities. By validating our findings with crypto-forensic tools, we uncover additional malicious addresses and provide actionable insights for law enforcement agencies.
Xihan Xiong, Zhipeng Wang, Qin Wang, William Knottenbelt
Decentralized communication is becoming an important use case within Web3. On Ethereum, users can repurpose the transaction input data field to embed natural-language messages, commonly known as Input Data Messages (IDMs). However, as IDMs gain wider adoption, there has been a growing volume of toxic content on-chain. This trend is concerning, as Ethereum provides no protocol-level support for content moderation. We propose two moderation frameworks for Ethereum IDMs: (i) BUILDERMOD, where builders perform semantic checks during block construction; and (ii) USERMOD, where users proactively obtain moderation proofs from external classifiers and embed them in transactions. Our evaluation reveals that BUILDERMOD incurs high block-time overhead, which limits its practicality. In contrast, USERMOD enables lower-latency validation and scales more effectively, making it a more practical approach in moderation-aware Ethereum environments. Our study lays the groundwork for protocol-level content governance in decentralized systems, and we hope it contributes to the development of a decentralized communication environment that is safe, trustworthy, and socially responsible.
The unique International Mobile Equipment Identity (IMEI) number is essential for identifying mobile devices and blacklisting stolen ones within networks. Current solutions are limited to local blacklists and lack a global mechanism for information exchange among operators. Efforts by the Global System for Mobile Communications Association (GSMA) to implement a common blacklist have been constrained by costs, resulting in fragmented and ineffective IMEI management systems. To address these challenges, we have developed a blockchain-based framework that uses the decentralized consensus and tamper-proof nature of distributed ledger technology to enable a unified and globally accessible IMEI blacklist. The framework is implemented on a permissioned blockchain deployed on the Sepolia testnet, utilizing the Proof of Authority (PoA) consensus mechanism to ensure fast and secure validation in a multi-stakeholder environment. Our solution includes a Decentralized Application (DApp) for user interaction, with smart contracts deployed using a Web3 wallet and connected via the Alchemy API to enable efficient communication between the front end and blockchain. Smart contracts automate device status verification, theft reporting, and transaction recording, enhancing transparency, accountability, and security in mobile device management. To validate IMEI numbers, the system uses the Luhn algorithm, a widely accepted checksum method. The framework also collaborates with law enforcement and insurance companies to improve theft verification and claims processing. Experimental results demonstrate the framework's scalability, achieving low latency of under 1 second at transaction rates up to 1,000 TPS and reducing transaction processing time by 30% compared to a traditional centralized database-based system. Performance outcomes were validated through 30 independent test runs to account for variability, underscoring the framework's robustness and potential for widespread adoption. These results set a new standard for global mobile device security through industry-wide collaboration.
Maruf Farhan, Usman Butt, Rejwan Bin Sulaiman, Mansour Naser Alraja
The widespread circulation of digital misinformation exposes a critical shortcoming in prevailing detection strategies, namely, the absence of robust mechanisms to confirm the origin and authenticity of online content. This study addresses this by introducing VeriTrust, a conceptual and provenance-centric framework designed to establish content-level trust by integrating Self-Sovereign Identity (SSI), blockchain-based anchoring, and AI-assisted decentralized verification. The proposed system is designed to operate through three key components: (1) issuing Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) through Hyperledger Aries and Indy; (2) anchoring cryptographic hashes of content metadata to an Ethereum-compatible blockchain using Merkle trees and smart contracts; and (3) enabling a community-led verification model enhanced by federated learning with future extensibility toward zero-knowledge proof techniques. Theoretical projections, derived from established performance benchmarks, suggest the framework offers low latency and high scalability for content anchoring and minimal on-chain transaction fees. It also prioritizes user privacy by ensuring no on-chain exposure of personal data. VeriTrust redefines misinformation mitigation by shifting from reactive content-based classification to proactive provenance-based verification, forming a verifiable link between digital content and its creator. VeriTrust, while currently at the conceptual and theoretical validation stage, holds promise for enhancing transparency, accountability, and resilience against misinformation attacks across journalism, academia, and online platforms.
Ch. Rupa, Sai Varshitha. G, D Divya, Thippa Reddy Gadekallu · 6 authors
The world faces a severe blood shortage, with a gap of 1.95 million units, highlighting the need for efficient blood allocation and management systems. Traditional cloud and blockchain approaches have been explored for blood bank management but faced implementation challenges. This study proposes designing and developing a decentralized Binance blockchain-based application framework to ensure transparency and security. It uses the AdaBoost algorithm to predict the availability of the nearest blood bank and blood donor. Supply chain management provides transparency without the intervention of third parties thereby preventing blood crimes. Metamask is incorporated for crypto transactions in the Binance Smart Chain test network (BSC). BSC stands out for its low transaction fees and high scalability, enabling swift transaction processing at a fraction of the cost compared to Ethereum. The smart contracts are deployed using hardhat configuration enabling BscScan as an Application Programming Interface (API) gateway to record transactions within the decentralized application (dApp). The proposed system achieved an accuracy of 99.5%, demonstrating the robustness of the AdaBoost model in predicting blood availability. The integration of blockchain technology ensures transparency, immutability, and secure traceability of blood transactions across the network.
Anthony Sai Richardo, Franz Adeta, Yohan Muliono, Michelle Hamjaya · 5 authors
Web3 airdrops have become a popular way to distribute tokens and raise project awareness, but their objective is frequently abused by bot activities. For example, the 2024 Hamster Kombat project reported detecting over 2.3 million automated bot interactions during its airdrop event. To address the problem, this research compares seven supervised machine learning models for detecting bot activity in Telegram-based Web3 airdrops by analyzing patterns in API requests. A total of 2600 data entries were collected: 1300 from real bot scripts and 1300 manually gathered using Telegram's built-in network tools. Each sample contains technical features such as HTTP request methods, URLs, request headers, and public IP addresses. These were further enriched with indicators of VPN usage, proxy connections, TOR relay presence, and whether the IP address was linked to a hosting provider. The result shows Gaussian Naïve Bayes and the MLP Classifier were the top performers, with$\mathbf{9 4. 4 1 \%}$validation accuracy,$\mathbf{9 4. 0 0 \%}$test accuracy, and 84.56 % accuracy when evaluated on a separate set of new data. These models accurately captured statistical patterns in bot data and complex interactions in human data. The results emphasize the importance of machine learning in securing Web3 token distribution processes.