This paper examines the dynamics of trust and bot-driven responses within the meme coin ecosystem on the Solana blockchain, with a particular emphasis on the interplay between social media-induced sentiment and on-chain transaction behaviors.Meme coins, which originate from internet culture and are heavily influenced by community sentiment, represent a volatile and distinct category of cryptocurrencies.Employing sentiment propagation networks, on-chain transaction data, and sentiment-transaction integrated models, we quantitatively analyze the relationship between emotional fluctuations and market behaviors.By contrasting Rug Pull scams with sustainable projects, we identify critical differences in the role of sentiment across different phases of project development.Our findings reveal three distinct sentiment-driven user trading behaviors: sentiment followers, makers, and stabilizers.The results indicate that, while sentiment is a primary driver of early-stage trading within Rug Pull projects, its influence diminishes as community distrust intensifies, resulting in more opportunistic and reactive trading patterns.This study contributes to the understanding of the co-evolution of memes, sentiment, and market dynamics, offering new insights into the complexities of decentralized finance ecosystems, with a specific focus on Solana-based meme coin markets.
S. M. Dilip Kumar, Namrta Tanwar, Namrta Tanwar, Aakarsh Chandna · 5 authors
The blockchain technology has disrupted the earlyage digital banking through concepts like bitcoin and ether [1,3].In this study, some major elements of the blockchain technology are examined-decentralized networks, smart contracts, cryptographic techniques, and consensus mechanisms of Proof of Work and Proof of Stake usage-and understanding how they contribute to safe, peer-to-peer transactions without intermediaries [2,5].Bitcoin can do no more than about seven transactions a second (TPS) is a very paltry competition of an impressive 30 to 40 TPS of Ethereum.This depicts the ongoing scalability challenges that need to be tackled by initiatives linked with Ethereum 2.0 and the Lightning Network [4,9].While most industries, apart from banking, have effectively made their blockchain applications and transparency useful-Supply Chain Management, Healthcare, and DeFi-currently poses challenges of transaction speed limitations, the vagueness of regulations, and energy consumption by mining [8].Emerging trends include Non-Fungible Tokens (NFTs), Central Bank Digital Currencies (CBDCs), and privacy enhanced through zero-knowledge proofs.There is hope for excellent feedback on the future of the blockchain from these and other initiatives yet to come into reality.
Yanqi Zhao, Minghong Sun, Min Xie, Xiaoyi Yang · 5 authors
As online application services evolve, an increasing number of users are opting for subscription-based or paywall models to access high-quality content. Anonymous counting tokens (ACTs), which regulate user access while protecting user privacy, are widely adopted in the online paywall model. However, the centralized server of ACT may lead to a single point of failure, thereby exposing users’ privacy. To address this challenge, in this paper, we propose threshold anonymous counting tokens with batch proofs (ThrACT) that balance privacy preservation and access count limitation for online paywalls. We define the system model for ThrACT and provide its concrete construction. We utilize the threshold Boneh-Boyen signature to facilitate distributed issuance of anonymous tokens and enable batch issuance. In addition, our ThrACT employs non-interactive zero-knowledge proofs to verify the label and token requests while allowing the correctness of multiple blind token shares to be validated simultaneously. We also prove that ThrACT satisfies unforgeable and unlinkable security properties. Finally, we evaluate the computational cost of our ThrACT and compare it with other schemes. The experiment result demonstrates that ThrACT not only supports distributed issuance, batch verification, and counting functionalities but also achieves computational overhead in milliseconds. In particular, when the threshold is set to (3,5), the token issuance time is approximately 9 milliseconds.
Information disorder has become a major societal challenge, impacting public discourse and democracy. This phenomenon has been exacerbated by the spread of social media platforms, affecting various areas, ranging from national elections to public health. Addressing fake news through a manual approach (e.g., human fact-checking) is unfeasible due to the rapid production of textual content. At the same time, applying automatic tools is equally challenging, primarily due to the ambiguity of natural language. In this paper, we addressed online information disorder from a different perspective by proposing a platform that supports trustworthy and reputable news producers and enhances awareness among readers across various social media. Specifically, the proposed platform enables news producers to automatically embed a unique watermark in the text they create, ensuring that the news cannot be manipulated or misattributed. The watermarking is embedded in a fine-grained way, allowing even small extracts of the news to be shared while preserving traceability. Additionally, the association between the watermark and the news item is recorded in a distributed ledger, preventing further manipulation that could arise from centralised management. The aim is to enable readers to make more informed decisions about the content they encounter, even when engaging with excerpts of the original document, minimising reliance on external fact-checking organisations.
Hao Wu, Maha Abdallah, Yuanfang Chi, Lehao Lin · 5 authors
In the Web3 ecosystem, multimedia applications exhibit significant potential by leveraging decentralization, regarded as the core spirit of Web3. This survey aims to provide a comprehensive overview of the potential of decentralization in shaping multimedia applications in the Web3 ecosystem. Through a systematic review of the academic research conducted over the past decade on Web3 decentralization, we identify the two key distinctive decentralization characteristics (decentralized assets and decentralized participation). Subsequently, we comprehensively analyze Web3 applications from both technology and application dimensions. Building upon this, we focus on multimedia-related aspects and propose an architecture for Web3 multimedia applications. In contrast to the broader scope of Web3 applications, the unique aspects of Web3 multimedia applications reside in their core application components (non-fungible tokens and smart contract-based rules) and core application domains (art, games, and social media). Based on this architecture, we provide a precise definition of Web3 multimedia applications. Lastly, through the lens of the two identified distinctive decentralization characteristics, we investigate the advantages, development, and limitations of Web3 multimedia applications within the three core application domains, namely crypto art, blockchain games, and blockchain on social media (BOSM). Furthermore, we share our insights into several promising yet challenging directions, covering the interoperability and potential of increasingly valuable multimedia content, as well as the delicate balance between centralization and decentralization.
This paper explores the vulnerability of machine learning models to simple single-feature adversarial attacks in the context of Ethereum fraudulent transaction detection. Through comprehensive experimentation, we investigate the impact of various adversarial attack strategies on model performance metrics. Our findings, highlighting how prone those techniques are to simple attacks, are alarming, and the inconsistency in the attacks' effect on different algorithms promises ways for attack mitigation. We examine the effectiveness of different mitigation strategies, including adversarial training and enhanced feature selection, in enhancing model robustness and show their effectiveness.
Phishing detection on Ethereum has increasingly leveraged advanced machine learning techniques to identify fraudulent transactions. However, limited attention has been given to understanding the effectiveness of feature selection strategies and the role of graph-based models in enhancing detection accuracy. In this paper, we systematically examine these issues by analyzing and contrasting explicit transactional features and implicit graph-based features, both experimentally and analytically. We explore how different feature sets impact the performance of phishing detection models, particularly in the context of Ethereum's transactional network. Additionally, we address key challenges such as class imbalance and dataset composition and their influence on the robustness and precision of detection methods. Our findings demonstrate the advantages and limitations of each feature type, while also providing a clearer understanding of how feature affect model resilience and generalization in adversarial environments.
In recent years, the Ethereum Name Service (ENS) has garnered significant attention within the community for enabling the use of Unicode in domain names, thereby facilitating the inclusion of a wide array of character sets such as Greek, Cyrillic, Arabic, and Chinese. While this feature enhances the versatility and global accessibility of domain names, it concurrently introduces a substantial security vulnerability due to the presence of homoglyphs-characters that are visually similar to others across Unicode and ASCII sets. These similarities can be exploited in homoglyph attacks, posing a distinct threat to domain name integrity. Despite community efforts to counteract this issue through a normalization process prior to domain resolution, our analysis uncovers significant discrepancies in how the normalization processes are applied across various applications. This inconsistency could result in the same domain name being resolved to different addresses in different applications, underscoring a critical vulnerability. We also discovered the new attack scenario in ENS which may cause legitimate domains resolved into malicious addresses even when they are verified by authorities. To systematically evaluate this inconsistency, we designed a tool for detecting application-level discrepancies in domain normalization process without requiring access to the application's source code. Our evaluation on hundreds of real-world Web3 applications identifies widespread deviations from established homoglyph mitigation practices, with more than 60% digital wallets and 80% dApps (decentralized applications) not able to produce consistent ENS resolving results, potentially impacting millions of users. This analysis underscores the urgent need for a standardized implementation of normalization processes to safeguard the integrity and security of ENS domains.
M. K. Ghosh, Swapnil Srivastava, Apoorva Upadhyaya, Raju Halder · 5 authors
Phishing scams on Ethereum have expanded with the surge of the platform, posing substantial challenges due to the sheer similarity in user behaviours and sparse temporal instances. Current methods often fail to tackle these concerns and overlook the temporal sequence of transactions, resulting in suboptimal performance. In this paper, we aim to address these gaps by focusing on the alignment of two aspects: (1) User-specific local temporal behavior, and (2) Divergences from global activity patterns of the network. Hence, we introduce CATALOG (CApturing joint TemporAl dependencies from LOcal and Global user behaviour), a novel representation learning model that jointly captures the local and global user behviours and their correlations by leveraging a dual cross-attention mechanism paired with a bi-directional Masked Language Modelling (MLM) transformer. Our proposed model simultaneously learns from local behavioral shifts, global market trends, and contextually enriched embeddings, effectively distinguishing phishing from non-phishing users while addressing existing research gaps. Extensive experiments on real-world Ethereum transaction data show that our framework improves phishing detection by 7-8% in the F1-Score along with demonstrating the generalization to Ethereum versions 1.0 and 2.0.
Kai Ma, Ningyu He, Jintao Huang, B. X. Zhang · 6 authors
Cybersquatting refers to the practice where attackers register a domain name similar to a legitimate one to confuse users for illegal gains. With the growth of the Non-Fungible Token (NFT) ecosystem, there are indications that cybersquatting tactics have evolved from targeting domain names to NFTs. This paper presents the first in-depth measurement study of NFT cybersquatting. By analyzing over 220K NFT collections with over 150M NFT tokens, we have identified 8,019 cybersquatting NFT collections targeting 654 popular NFT projects. Through systematic analysis, we discover and characterize seven distinct squatting tactics employed by scammers. We further conduct a comprehensive measurement study of these cybersquatting NFT collections, examining their metadata, associated digital asset content, and social media status. Our analysis reveals that these NFT cybersquatting activities have resulted in a significant financial impact, with over 670K victims affected by these scams, leading to a total financial exploitation of $59.26 million. Our findings demonstrate the urgency to identify and prevent NFT squatting abuses.
Pieter Hartel, Marianne Junger, Mark van Staalduinen
Abstract Objective This study examines Bitcoin generator (BG) websites on the clear and dark web. It focuses on their prevalence, revenue, and associated warnings, as these sites are suspected scams. Method Data for the study was gathered from the Dark Web Monitor and Iknaio Cryptoasset Analytics. A four-step process was used to identify BG sites and their Bitcoin addresses from 2 million dark websites. Results We found 832 dark web BG sites. The monetary revenue from a dark web BG site is approximately 1/3 smaller per Bitcoin address than from a clear web BG site. There is a concentration of revenue at a few BG sites. Only 24% of Bitcoin addresses on dark web BG sites have ever had money deposited on them. On the dark web, the top three clusters of crypto addresses account for 35% of the total revenue. On the clear web, the top three clusters account for 52% of the total revenue. The longer BG sites are online, the higher the revenue. There are hardly any warnings against BG sites. Conclusion Our results fit the Rational Choice model of crime: the revenue is modest, but the effort of the offenders is also limited.
As a novel decentralized computing paradigm, blockchain is expected to disrupt the existing e-commerce architecture and process. Secure smart contracts are the crucial foundation for e-commerce based on blockchain. However, vulnerabilities in smart contracts occur from time to time and cause significant financial losses in e-commerce. Some static verification methods have been developed to guarantee security for e-commerce smart contracts at design time, but they cannot support complex scenarios at runtime. As a lightweight verification method, runtime verification is a potential method for secure e-commerce smart contracts. The existing runtime verification methods are based on the manual instrument, which leads to additional overheads and gas consumption. To deal with this, we propose a passive learning-based runtime verification framework for e-commerce smart contracts. Firstly, by exploring the Genetic algorithm to evolve state merging and automaton reorganizing in order to simultaneously split time and gas behaviors, we propose a passive learning method to model runtime information for e-commerce smart contracts (PL4ESC). It directly learns P2TA (priced probabilistic timed automaton) from runtime traces without any prior knowledge. Then, we integrate PL4ESC with the open-source PAT (Process Analysis Toolkit) to automatically verify the security of runtime e-commerce smart contracts. The experiments show that PL4ESC is better at accuracy and precision than state-of-the-art passive learning methods. It improves accuracy by 1 to 4 percent compared to TAG and RTI+. As far as we know, it is not only the first learning method that can learn a P2TA from traces, but it is also the first automated runtime verification framework for e-commerce smart contracts. This will provide security guarantees for blockchain-based e-commerce.
As the development of Solidity contracts on Ethereum , more developers are reusing them on other compatible blockchains. However, developers may overlook the differences between the designs of the blockchain system, such as the Gas Mechanism and Consensus Protocol , leading to the same contracts on different blockchains not being able to achieve consistent execution as on Ethereum . This inconsistency reveals design flaws in reused contracts, exposing code smells that hinder code reusability, and we define this inconsistency as EVM-Inequivalent Code Smells . In this paper, we conducted the first empirical study to reveal the causes and characteristics of EVM-Inequivalent Code Smells . To ensure the identified smells reflect real developer concerns, we collected and analyzed 1,379 security audit reports and 326 Stack Overflow posts related to reused contracts on EVM-compatible blockchains, such as Binance Smart Chain (BSC) and Polygon . Using the open card sorting method, we defined six types of EVM-Inequivalent Code Smells . For automated detection, we developed a tool named EquivGuard . It employs static taint analysis to identify key paths from different patterns and uses symbolic execution to verify path reachability. Our analysis of 905,948 contracts across six major blockchains shows that EVM-Inequivalent Code Smells are widespread, with an average prevalence of 17.70%. While contracts with code smells do not necessarily lead to financial loss and attacks, their high prevalence and significant asset management underscore the potential threats of reusing these smelly Ethereum contracts. Thus, developers are advised to abandon Copy-and-Paste programming practices and detect EVM-Inequivalent Code Smells before reusing Ethereum contracts.
M. K. Ghosh, Chirag Dinesh Jain, Raju Halder, Joydeep Chandra
Phishing scams on the Ethereum network have become a serious threat, especially with the influx of new users into the cryptocurrency market. Current detection methods are mainly focused on long-term consistent transaction patterns with smooth temporal dynamics. However, these methods often struggle to differentiate between phishing and non-phishing users, whose behaviours may appear deceptively similar. Additionally, they face challenges such as network sparsity and data leakage, leading to significant performance limitations. To address these issues, we introduce TEMPER, a novel sequential learning framework designed to jointly capture the subtle distinctions between long- and short-term user behaviours and their correlations to provide more comprehensive insights. TEMPER effectively generates distinguishable user embeddings, enabling the accurate identification of phishing users. Unlike previous approaches, TEMPER mitigates data leakage through a novel sequential transaction sampling algorithm and addresses network sparsity with short-term temporal learning. Through extensive experimentation on three real-world Ethereum datasets, TEMPER demonstrates its efficacy by achieving a 3-4% improvement in the F1-Score compared to existing baseline models, representing a significant advancement in Ethereum phishing user detection.
Junhao Wu, Yixin Yang, Chengxiang Jin, Silu Mu · 8 authors
With the widespread adoption of Ethereum, financial frauds such as Ponzi schemes have become increasingly rampant in the blockchain ecosystem, posing significant threats to the security of account assets. Existing Ethereum fraud detection methods typically model account transactions as graphs, but this approach primarily focuses on binary transactional relationships between accounts, failing to adequately capture the complex multi-party interaction patterns inherent in Ethereum. To address this, we propose a hypergraph modeling method for the Ponzi scheme detection method in Ethereum, called HyperDet. Specifically, we treat transaction hashes as hyperedges that connect all the relevant accounts involved in a transaction. Additionally, we design a two-step hypergraph sampling strategy to significantly reduce computational complexity. Furthermore, we introduce a dual-channel detection module, including the hypergraph detection channel and the hyper-homo graph detection channel, to be compatible with existing detection methods. Experimental results show that, compared to traditional homogeneous graph-based methods, the hyper-homo graph detection channel achieves significant performance improvements, demonstrating the superiority of hypergraph in Ponzi scheme detection. This research offers innovations for modeling complex relationships in blockchain data.
Kyounggon Kim, Seok‐Hee Lee, Sundaresan Ramachandran, Ibrahim Alzahrani
Cybercriminals are employing sophisticated techniques to illegally obtain money from victims, with ransomware, that is the most notorious malware utilized for financial gain. This paper focuses on the Arab world, a prime target region for ransomware gangs. Due to rapid economic growth and digitalization in this region, cybercriminals are increasingly targeting it. However, there is a lack of research on ransomware crime syndication in the Arab region. Data on claimed ransomware victims from 2020 to 2023 was collected from the darknet. Analysis of ransomware gangs in this area revealed significant findings. Based on three years of data collection and analysis, 20 ransomware gangs primarily operating in the Arab region were identified in 2023. Three major ransomware gangs-LockBit, ALPHV/BlackCat, and CL0P-are predominantly targeting the Arab world, with the United Arab Emirates and Saudi Arabia being major targets, along with the manufacturing industry. In addition to identifying the ransomware gangs, the tactics, techniques, and procedures (TTP) used by them were also identified. There was 17 TTPs used by ransomware gangs. This study has also developed a platform to track ransomware gangs and cryptocurrency transactions. Bitcoin’s anonymity and popularity made it the most preferred cryptocurrency by ransomware gangs. This research lays the groundwork for further studies to understand the exact trends and data related to ransomware in the Arab world.
The decentralized, open-source architecture of blockchain technology, exemplified by the Ethereum platform, has transformed online transactions by enabling secure and transparent exchanges. However, this architecture also exposes the network to various security threats that cyber attackers can exploit. Detecting suspicious behaviors in account on the Ethereum blockchain can help mitigate attacks, including phishing, Ponzi schemes, eclipse attacks, Sybil attacks, and distributed denial of service (DDoS) incidents. The proposed system introduces an ensemble stacking model combining Random Forest (RF), eXtreme Gradient Boosting (XGBoost), and a neural network (NN) to detect potential threats within the Ethereum platform. The ensemble model is fine-tuned using Bayesian optimization to enhance predictive accuracy, while explainable artificial intelligence (XAI) tools-SHAP, LIME, and ELI5-provide interpretable feature insights, improving transparency in model predictions. The dataset used comprises 9,841 Ethereum transactions across 52 initial fields (reduced to 17 relevant features), encompassing both legitimate and fraudulent records. The experimental findings demonstrate that the proposed model achieves a superior accuracy of 99.6%, outperforming that of other cutting-edge methods. These findings demonstrate that the XAI-enabled ensemble stacking model offers a highly effective, interpretable solution for blockchain security, strengthening trust and reliability within the Ethereum ecosystem.
Zheng Lu, Tao Feng, Zilong Xie, Xiaomin Li · 5 authors
Mobile crowdsensing (MCS) utilizes sensors distributed across different vehicles to support intelligent transportation and environmental monitoring. Recently, most of the research on MCS in Internet of Vehicles (IoV) mainly focuses on privacy protection and data security of anonymous authentication, but there are still shortcomings in reliability evaluation and reputation management of sensing vehicles. Besides, the lack of effective management of identity information may lead to difficulties in tracking malicious behavior. In this article, we propose a blockchain-assisted anonymous authentication and reputation management (BARM) scheme for MCS in IoV. Specifically, an efficient anonymous authentication algorithm is proposed for sensing vehicles. Then, the privacy protection reputation evaluation algorithm is proposed to ensure the reliability of the sensing vehicles and the security of sensing data. Meanwhile, an accurate reputation update algorithm is proposed to effectively check and update the reputation values of participating sensing vehicles. Besides, the smart contracts are written and deployed on the blockchain to manage the information of the sensing vehicles, which improves the security, efficiency, and trust of the identity management. Subsequently, a formal security verification method based on colored petri net (CPN) and Dolev-Yao attacker model is proposed to evaluate the security of the scheme. The evaluation results show that the scheme can effectively resist a variety of different types of attacks and has multiple security attributes. Performance analysis shows that the proposed scheme has low computation and communication overheads and high robustness.
As cryptocurrency transactions continue to grow, detecting scams within transaction records remains a critical challenge. These transactions can be represented as dynamic graphs, where Neural Network Convolution (NNConv) models are widely used for detection. However, NNConv models suffer from model decay due to evolving transaction patterns, the introduction of new users, and the emergence of adversarial techniques designed to evade detection. To address this issue, we propose an automated, periodic hyperparameter optimization method based on proximal policy optimization (PPO), a reinforcement learning algorithm designed for dynamic environments. By leveraging PPO’s stable policy updates and efficient exploration strategies, our approach continuously refines hyperparameters to sustain model performance without frequent retraining. We evaluate the proposed method on a large-scale cryptocurrency transaction dataset containing 2,973,489 nodes and 13,551,303 edges. The results demonstrate that our method achieves an F1 score of 0.9478, outperforming existing graph-based approaches. These findings validate the effectiveness of PPO-based optimization in mitigating model decay and ensuring robust cryptocurrency scam detection.
Detecting fraudulent activities such as Ponzi schemes within smart contract transactions is a critical challenge in decentralized finance. Existing methods often fail to capture the heterogeneous, multi-faceted nature of blockchain data, and many graph-based models overlook the contextual patterns that are vital for effective anomaly detection. In this paper, we propose MVCG-SPS, a Multi-View Contrastive Graph Neural Network designed to address these limitations. Our approach incorporates three key innovations: (1) Meta-Path-Based View Construction, which constructs multiple views of the data using meta-paths to capture different semantic relationships; (2) Reinforcement-Learning-Driven Multi-View Aggregation, which adaptively combines features from multiple views by optimizing aggregation weights through reinforcement learning; and (3) Multi-Scale Contrastive Learning, which aligns embeddings both within and across views to enhance representation robustness and improve anomaly detection performance. By leveraging a multi-view strategy, MVCG-SPS effectively integrates diverse perspectives to detect complex fraudulent behaviors in blockchain ecosystems. Extensive experiments on real-world Ethereum datasets demonstrated that MVCG-SPS consistently outperformed state-of-the-art baselines across multiple metrics, including F1 Score, AUPRC, and Rec@K. Our work provides a new direction for multi-view graph-based anomaly detection and offers valuable insights for improving security in decentralized financial systems.