Non-fungible tokens (NFTs) serve as a representative form of digital asset ownership and have attracted numerous investors, creators, and tech enthusiasts in recent years. However, related fraud activities, especially phishing scams, have caused significant property losses. There are many graph analysis methods to detect malicious scam incidents, but no research on the transaction patterns of the NFT scams. Therefore, to fill this gap, we are the first to systematically explore NFT phishing frauds through graph analysis, aiming to comprehensively investigate the characteristics and patterns of NFT phishing frauds on the transaction graph. During the research process, we collect transaction records, log data, and security reports related to NFT phishing incidents published on multiple platforms. After collecting, sanitizing, and unifying the data, we construct a transaction graph and analyze the distribution, transaction features, and interaction patterns of NFT phishing scams. We find that normal transactions on the blockchain accounted for 96.71% of all transactions. Although phishing-related accounts accounted for only 0.94% of the total accounts, they appeared in 8.36% of the transaction scenarios, and their interaction probability with normal accounts is significantly higher in large-scale transaction networks. Moreover, NFT phishing scammers often carry out fraud in a collective manner, targeting specific accounts, tend to interact with victims through multiple token standards, have shorter transaction cycles than normal transactions, and involve more multi-party transactions. This study reveals the core behavioral features of NFT phishing scams, providing important references for the detection and prevention of NFT phishing scams in the future.
In today’s technologically advancing world, many fields from finance to healthcare and education are shifting toward a digital and decentralized format. A significant transformation is underway with the currency of the masses. Blockchain-based cryptocurrencies like Bitcoin and Ethereum allow users to generate fungible tokens anonymously through smart contracts. However, these features also facilitate illicit transactions and cybercrimes like fraud, phishing, and money laundering. The proposed work explores the identification of suspicious transactions on the Ethereum blockchain by leveraging advanced machine-learning techniques. An Extreme Gradient Boosting (XGBoost) classifier is optimized for spotting unauthorized or malicious transactions, exploring features like transaction patterns and value anomalies. Feature scaling and log transformations normalize skewed distributions, while rigorous model training and hyperparameter tuning enhance the system's precision, recall, and overall accuracy. Other aids, such as feature importance rankings, precision-recall curves, and diagnostic statistics, provide useful information on fraud patterns. Evaluation of the model shows that integrating cost-sensitive learning significantly reduces false positives, from 51 to 44, representing a 13.7% decrease, which enhances practical usability by minimizing false alerts and manual verification efforts. Although there was a slight increase in false negatives (from 14 to 15), the overall classification accuracy improved. The model demonstrated strong performance in managing class imbalance which is common in fraud detection contexts.
Jianlong Xu, C. F. Xu, Rongtao Zhang, Feixiang Diao · 5 authors
With the wide application of blockchain technology in finance, IoT, healthcare, and other fields, phishing scams have emerged as a growing security threat. Existing detection methods often lack in-depth modeling of the directional properties of transaction flows and struggle to effectively capture diverse transaction behaviors, directional relationships, and key neighbor dependencies. To address these limitations, we propose TGAT-MPGCN, a direction-aware phishing detection model that constructs three complementary first-order subgraphs, a sending graph, a receiving graph, and a bidirectional graph to explicitly capture transaction directionality. By integrating a graph-attention mechanism with weighted neighbor aggregation, the model enhances feature learning. Experimental evaluations on an Ethereum transaction dataset demonstrate the superior performance of our approach, achieving an accuracy of 97.21%, an AUC of 0.9721, an F1-score of 0.9719, a recall of 0.9629, and a precision rate of 98.11%, significantly outperforming traditional detection methods. This study offers a practical and scalable solution for accurate phishing detection in blockchain transaction networks.
Nov 28, 2025·2025 IEEE 1st International Conference on Smart Innovations in Systems, Infrastructure, Mechanical, Power, AI and Computing Technologies (SISIMPACT)
Vishwa Nath Sharma, Amit Chouksey, K. Pithambar, Pankaj Agarwal · 6 authors
This research describes how we implemented machine learning technology to help detect malicious participants on the Ethereum blockchain, including fake smart contracts and honeypots. Honeypots are built to fool attackers into approaching them, as they act like vulnerable smart contracts. The work unites data science, blockchain and machine learning to help the system tell apart honeypot contracts from other types. The chosen system collects all necessary information about Ethereum contracts from the Etherscan API and sorts the data by method, transaction behavior and flow of funds. These aspects are applied to create and review an XGBoost classifier model. The model is tested in three different ways: using real data as a reference, with attackers as adversarial honeypots and by looking at its cost-benefit analysis. This unique way of tracing enables greater ease of updating, fully automated analysis and stronger accuracy while watching smart contracts live. Using machine learning in honeypot detection is an important step toward protecting decentralized applications by spotting and handling threats early in the blockchain system. With XGBoost as its foundation, the suggested honeypot detection approach achieves a total accuracy of 98.78 %. The high proportion is a result of the model's impressive accuracy in identifying honeypot and non-honeypot electronic contracts.
The detection of illicit cryptocurrency transactions remains a significant challenge due to the extreme class imbalance and limited generalization capabilities of machine learning models applied to Anti–Money Laundering (AML) data. In the widely used Elliptic dataset, illicit transactions represent less than 2% of all nodes, creating a high-risk setting in which models can achieve deceptively high training accuracy while failing to meaningfully identify malicious behavior. This study examines the behavior of Graph Neural Networks (GNNs) under these constraints and emphasizes the limitations rather than the performance of the approach. Instead of treating the model’s high training accuracy as a success, we demonstrate how imbalance, structural sparsity, and label noise impede reliable learning. We evaluate the model with and without common imbalance-handling strategies including class weighting and focal lossand illustrate that performance remains unstable. Furthermore, we investigate the explainability of the model using GNNExplainer, showing example subgraphs and salient features for known illicit nodes, and discuss their alignment with money-laundering patterns such as fan-out and transaction mixing. Our findings underscore the difficulties of applying GNNs to heavily imbalanced AML datasets and highlight the need for improved modeling strategies, semi-supervised techniques, and more robust explainability methods for real-world financial crime detection.
The rapid expansion of digital banking ecosystems has intensified the demand for real-time fraud detection architectures capable of operating at cloud scale.As financial transactions increasingly traverse mobile platforms, API-driven services, embedded finance channels, and cross-border payment networks, fraud patterns have become more dynamic, decentralized, and behaviorally complex.This shift has exposed the limitations of legacy rule-based systems, which lack the adaptability, latency tolerance, and threatintelligence integration required to counter emerging risks.To address these challenges, cloud-native risk orchestration layers have emerged as a foundational component of next-generation fraud detection, delivering high-throughput data ingestion, elastic compute, and intelligent decisioning frameworks suited for modern digital banking environments.At a broader level, cloud-native risk orchestration unifies distributed event streams, machine-learning scoring engines, and policy-management modules within a scalable, microservices-based architecture.This enables fraud systems to process high-velocity transactional, behavioral, and device-identity signals with millisecond latency.As the narrative narrows, the paper explores how real-time fraud detection leverages cloud services such as serverless functions, container orchestration, distributed caching, and streaming analytics to enable adaptive detection pipelines.It further examines how federated intelligence, feature stores, and continuous learning loops enhance model accuracy while maintaining compliance with privacy and data-residency requirements.At its core, the proposed framework emphasizes explainability, risk transparency, and operational resilience incorporating alert-triage routing, anomaly-suppression mechanisms, decision traceability, and integration with case-management workflows.By combining cloud-native design principles with advanced fraud analytics, the paper outlines a comprehensive blueprint for financial institutions seeking to modernize their risk-management stack.This unified approach offers a path toward scalable, real-time, and intelligence-driven fraud prevention that adapts to evolving threats while supporting regulatory compliance and customer trust.
Nov 28, 2025·2025 IEEE 1st International Conference on Smart Innovations in Systems, Infrastructure, Mechanical, Power, AI and Computing Technologies (SISIMPACT)
Deepak Singh Rana, Rahul Rathi, Tomi Ete, Sunil Kumar Shah · 6 authors
For this research, a strong framework is suggested for recognizing fraudulent Ethereum transactions by using both ML and DL approaches. As more people adopt Ethereum for DeFi, NFTs and smart contracts, the integrity of the system is being threatened more often. To deal with these difficulties, the work presents a hybrid RFDNN model which is trained over a labeled dataset of 9,841 Ethereum transactions, including 2,179 that are fraudulent. Class imbalance presents a big issue, so an advanced version of the Synthetic Minority Oversampling Technique (ISMOTE) is used to produce better synthetic data samples that make the model more general. To avoid overfitting and increase results in the real world, the methodology stresses feature engineering, data cleaning and adjusting for the right partitions. The research compares how traditional fraud detection works with adaptive ML models and highlights how adapting to new situations can catch more updated as well as advanced fraud. We need to ensure that any automated fraud system is both understandable and can handle large amounts of data for people to put faith in it. This study reveals that staying flexible and re-training models regularly is important due to the growing number of threats. Experiments were done with Logistic Regression (LR), Decision Tree (DT), Gradient Boosting (GB) and XGBoost, with the hybrid RFDNN model reaching the best results: 97% accuracy, 96% precision, 96% recall and a 97% F1 score.
This paper unveils a pioneering modular framework for Decentralized Explainable Artificial Intelligence (DeXAI), harnessing blockchain to deliver unparalleled trust and clarity in AI systems. Addressing the opacity and privacy challenges of centralized AI, our framework integrates federated learning with Explainable AI (XAI) methods, namely SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME), to produce intuitive explanations for AI decisions across distributed networks. A blockchain layer secures predictions and explanations, with smart contracts ensuring ethical compliance and auditable trails. Designed for adaptability, the framework supports diverse AI models and blockchain platforms, excelling in critical sectors like healthcare and finance. Our prototype validates its scalability and effectiveness, setting a new benchmark for trustworthy AI.
Jennifer Bala, Sikiru O. SUBAIRU, Noel M. DOGONYARO, Joseph A. OJENIYI · 5 authors
Blockchain technology, particularly Ethereum, has revolutionized decentralized finance by enabling transparent, secure, and programmable smart contracts. However, these same features have created avenues for financial crimes such as Ponzi schemes, where fraudulent actors exploit pseudonymity and the absence of centralized oversight to deceive investors. This study develops an optimized hybrid detection model that combines eXtreme Gradient Boosting (XGBoost) and Gated Recurrent Units (GRU) to identify Ponzi schemes in Ethereum transaction networks. The model integrates XGBoost’s capability for structured feature learning with GRU’s temporal sequence modeling to capture both static and dynamic behavioral patterns of smart contracts. Using a dataset of 3,866 labeled Ethereum contracts obtained from Kaggle, the research employed advanced preprocessing, temporal sequence enrichment, and class balancing through SMOTE-TS to mitigate data imbalance. Bidirectional optimization, incorporating attention-enhanced GRUs and Bayesian hyperparameter tuning for XGBoost, further improved learning performance and generalization. The model was evaluated using precision, recall, F1-score, ROC-AUC, and PR-AUC, achieving higher detection accuracy of 99% (F1-score = 0.945, ROC-AUC = 0.983) than standalone XGBoost or GRU models. Results demonstrate the hybrid model’s superior ability to detect temporal and statistical anomalies, reducing false negatives and improving early detection of fraudulent contracts. The approach contributes a scalable and interpretable framework for real-time Ponzi detection in blockchain ecosystems. This research not only enhances the reliability of Ethereum’s financial ecosystem but also offers regulators and developers a novel tool for proactive fraud prevention. Future work could extend this framework to multi-chain detection systems and real-time forensic monitoring.
Smart contract vulnerabilities hinder the development of decentralized finance (DeFi) applications due to overarching attacks and their impact on financial transactions. While rule-based static analysis tools can detect common exploits, they often fail to uncover subtle or rapidly evolving vulnerabilities. Moreover, dynamic analysis techniques over-rely on patterns, limiting token representation and explainability of attack detection. We introduce a novel architecture that unites Abstract Syntax Trees (ASTs) with a transformer-based deep learning framework to improve the detection of vulnerable smart contracts. By encoding Solidity-based smart contracts into ASTs, the structural context essential for capturing complex code dependencies is retained. Furthermore, the transformer model captures the context, dependencies, and semantics of vulnerabilities. Our performance evaluations show that the AST-transformer-based vulnerability detection method improved the detection rate precision by 4% compared to RNN, LSTM, GNN and vanilla transformer-based detection techniques. Additionally, we use SHapley additive explanation to determine the contribution of each to explain and reason the vulnerability detection. Moreover, we use saliency maps (heatmaps) to identify the line of code that is attributed to vulnerability detection.
Non-fungible tokens (NFTs) are unique digital assets that play an increasingly important role in decentralized markets, supporting new forms of ownership, valuation, and exchange. Their inherently multimodal structure, which encompasses visual content, metadata, and trading history, has led to a growing academic interest in modeling NFT pricing and market behavior. However, existing research is limited by the lack of comprehensive datasets that unify these modalities with consistent formatting and longitudinal coverage. To address this gap, we introduce MultiNFT, a large-scale multimodal dataset comprising 50 curated profile picture (PFP) NFT collections, including 523,020 unique assets and 2.38 million transaction records from April 2021 to September 2025. MultiNFT integrates standardized images, structured metadata, and time-series trading data, along with rarity scores and aesthetic features, offering a unified foundation for multimodal learning and NFT analytics. Unlike prior datasets that focus on visual similarity or static snapshots, MultiNFT captures evolving valuation dynamics across market cycles and connects them to trait-level characteristics. We demonstrate the utility of the dataset through three case studies, including within-collection rarity-price analysis, visual feature clustering across collections, and quantifying feature contributions in a comprehensive pricing model. By bridging computer vision, behavioral modeling, and financial forecasting, MultiNFT supports a wide range of interdisciplinary research and practical use cases. The dataset is publicly available and is intended to promote reproducible experimentation and further exploration of the mechanisms driving value in digital asset ecosystems.
Existing Ethereum phishing scam detection methods based on graph neural networks focus on subgraph sampling while ignoring the global structure of the transaction network. When applied to graph structures, the sequence length of Transformers grows exponentially with the number of hops, leading to convergence issues for Transformer-based methods when applied to large-scale Ethereum data. To address these issues, this paper proposes a global graph transformer for Ethereum account detection, (GGTEAD). GGTEAD integrates node global attention extracted via dimensionality reduction algorithms with node local attention to strengthen transactional relationships between nodes. By introducing effective edge weighting strategies and anomaly scoring mechanisms, it significantly enhances detection capabilities for minority phishing accounts. This addresses the challenge of poor detection performance for phishing scam accounts within large-scale, heterogeneous Ethereum networks, providing valuable insights for IoT-blockchain integrated environments. The experimental findings, derived from two authentic Ethereum datasets (MulDiGraph and B4E) demonstrate that GGTEAD attains F1 scores of 84.36% and 71.22%, respectively, signifying enhancements of 5.53% and 2.88% over the prevailing state-of-the-art methods ScamSweeper and Bert4eth.
Ethereum is one of the key platforms in public blockchain networks. Ethereum used for various critical applications like decentralized finance (DeFi), smart contract based and supply chain operations etc., Because of its growing popularity along with its open and anonymous nature, network can contribute fraudulent or abnormal transactions. The existing anomaly detection methods suffer from real time detection as they use rule based or statistical methods. These methods are failed to identify dynamic or structural transactional anomalies and has no consensus verification. To address these challenges, in this study we designed an anomaly detection model that features rule based logic, Graph Neural Networks with GraphSAGE and Consensus-driven Complex Event Processing (CEP). We developed this model by combining three key procedures primarily the transactions are fetched from live Ethereum network and presented to rule based filtering. Graph construction and feature extraction will be done at second stage in the model to understand structural pattern and detects dynamically evolving abnormal patterns. In final phase consensus verification introduced as novel contribution in this model to reduce false positives. The framework tested for live Ethereum data that shows improvements detection accuracy of GNN model with low latency time. On the whole, the proposed system model supports practical security monitoring in Ethereum networks. This framework efficiently helps in detecting fraud or abnormal transactions that degrades the performance, reliability or accuracy of the decentralized network.
The rise of non-fungible tokens (NFTs) has increased the risk of fraud and market manipulation. This study introduces a method for detecting wash trading in the NFT marketplace using Graph Neural Networks (GNNs) applied to Ethereum blockchain transaction data. We constructed a heterogeneous graph, used Depth-First Search for labelling, and extracted graph features, including PageRank and degree centrality. We evaluate various classification models: Multilayer Perceptron (MLP), Graph Convolutional Neural Network (GCN), and Heterogeneous Graph Convolutional Neural Network (HeteroGCN). The results show that GNN models, particularly the feature-enhanced HeteroGCN, exhibit superior performance compared to featureless models and traditional tabular baselines. The key contribution of this study is that PageRank and Degree Centrality features significantly improve the accuracy of identifying transactions involved in market manipulation.
Harsh Rudrawar, Sumitra A. Jakhete, Dhanashree Somani
Decentralized Finance (DeFi) has exposed users to sophisticated attacks (flash loans, rug pulls, phishing scams), while conventional, centralized fraud detection methods remain ineffective due to issues of privacy, data fragmentation, and lack of transparency. This paper introduces a novel hybrid framework for real-time fraud detection combining off-chain Machine Learning (ML) intelligence with on-chain smart contract enforcement via decentralized Chainlink oracles. Unlike existing ML systems that only flag behavior post-event, our design enables proactive mitigation, allowing smart contracts to automatically pause suspicious transactions or block malicious wallets based on real-time risk scores. Using an Ethereum dataset ($\approx 1.2$million transactions), the proposed model achieved an F1-score of 95.70% with XGBoost, outperforming traditional algorithms. The framework also demonstrated efficient operation, maintaining an average oracle latency of 1.25 seconds and an on-chain cost of 0.0041 ETH per action. Future work will explore privacy-preserving ML, cross-chain detection, and DAOgoverned explainable AI to improve transparency and trust in DeFi ecosystems.
Sheikh Sharfuddin Mim, Doina Logofătu, Gabriel Guerrero-Contreras, Inmaculada Medina‐Bulo
Federated learning (FL) offers a compelling solution to the privacy and compliance challenges that plague the financial industry by enabling decentralized machine learning without the need for raw data sharing. As regulations like GDPR and the GLBA enforce strict data protection requirements, financial institutions are increasingly exploring FL as an avenue for collaborative intelligence. This paper presents a comprehensive analysis of state-of-the-art FL algorithms tailored for finance, evaluates their performance across realistic tasks such as credit scoring, fraud detection, and customer segmentation, and identifies the trade-offs among performance, fairness, privacy, and communication cost. We benchmark twelve prominent FL algorithms, highlight their privacy implications with differential privacy and secure aggregation, and provide practical, strategic recommendations for deploying FL systems in financial environments. The study closes with a discussion on regulatory alignment, deployment challenges, and future directions for ethical and robust FL adoption in finance.
Blockchain is a distributed ledger technology that provides pseudo-anonymity among participants to maintain privacy. However, malicious actors utilise this property to hide their illegal rewards received through cyber attacks, dark market trades, money laundering and Ponzi schemes. The recent confiscation by the FBI of more than $4 million USD worth of bitcoin from the ‘Silk Road’ dark marketplace indicates the scale of the problem faced by financial regulators and law enforcement authorities. Analysing and identifying harmful actors is, therefore, necessary to regulate the transactions of digital assets. Machine learning models can assist in detecting patterns and correlations between the actors in blockchain networks that may not be apparent through traditional methods. In blockchain networks, the number of actors linked to illegal activities is significantly smaller than that of regular activities. Also, only very limited labelled transaction data is available about these malicious actors. These limitations make it harder to train supervised learning models to provide real-time proactive responses. This article represents a pioneering effort in thoroughly examining the different unsupervised learning methods for clustering suspicious behaviour of actors within blockchain networks. The proposed unsupervised learning-based analysis considers metadata and interconnectivity information of blockchain transactions. The metadata contains time-based and amount-based information. Interconnectivity data represents centrality measures and embedding vectors of the blockchain network. The quality of the identified clusters is validated using internal and external cluster validation measures. The validation results were used to identify influential features using the eXplainable AI technique Shapley (ShAP) values. The results reveal that the features related to the spending and receiving transactions strongly influenced cluster identification. Overall, the centroid-based and connectivity-based approaches identified well-separated clusters for metadata and centrality-based features of blockchain transactions.