Cryptocurrency KOL communities exhibit a paradoxical trust dynamic: pseudonymous strangers coordinate substantial capital within days, yet the same communities collapse once monetization, dissent suppression, and power concentration escalate. We develop the Crypto Community Trust Dynamics Chain (CCTDC), a six-phase recursive process model theorizing how platform affordances compress tri-dimensional emotional resonance (cognitive, affective, identity) into ephemeral trust, how exploitation unfolds along a five-level gradient, and how fission diverges into resonance maintenance, reform advocacy, or awakened departure. The model distinguishes ephemeral from swift trust, operationalizes identity resonance and narrative capacity, and treats the boundary condition as endogenously coupled.
Blockchain technology is frequently characterized as inherently transparent and tamper-resistant, suggesting strong potential for improving auditability and integrity in cryptocurrency fraud investigations. However, practical forensic outcomes often fall short of these expectations due to regulatory fragmentation, anonymity-enhancing mechanisms, decentralized infrastructures, and limitations in audit and investigative tooling. This study develops a structured conceptual framework to explain the gap between blockchain’s theoretical transparency and real-world forensic accounting capability. Synthesizing 70 relevant studies from an initial pool of 279 published manuscript, the paper organizes cryptocurrency forensic constraints into macro-level barriers and operationalizes them through twenty literature-derived critical factors. We further develop a temporal framework that distinguishes persistent constraints from emergent challenges, demonstrating how investigative bottlenecks evolve as cryptocurrency ecosystems mature. By linking barriers and operational factors to forensic accounting capability and investigative outcomes, the study provides an integrated and time-sensitive foundation for future empirical validation and capability development in decentralized financial environments.
Through this independent concept, the study introduces a fresh new perspective to the world of modern forensic accounting via a theory called “The Decentralized Fraud Matrix” (DFM). This conceptual research was developed specifically as an analytical tool to dissect the modus operandi of financial crimes in the digital-cyber era—including Web3 environments, blockchain architecture, DeFi protocols, and autonomous DAO systems. The focus of the DFM theory completely breaks away from the basic assumptions of the conventional fraud triangle, which has long been overly preoccupied with measuring human emotions. Mechanically, the originality of this theory rests on the testing of three interlocking cyber indicators in the field. These three indicators include the level of opacity in an actor’s digital identity concealment; technological engineering designed to break the audit trail of fund flows; and the exploitation of loopholes in physical national sovereignty boundaries, as well as cyber “jurisdictional evasion” tactics aimed at neutralizing the enforcement power of on-ground regulations, thereby rendering perpetrators immune to formal legal prosecution
Ovaj rad analizira transformativnu ulogu kriptovaluta u infrastrukturi savremenog organizovanog kriminala, argumentujući da blockchain tehnologija nije samo novi alat za stare kriminalne prakse, već da konstituiše kvalitativno novu kriminalnu ekonomsku arhitekturu koja mijenja temeljne odnose između kriminalnih aktera, žrtava i institucija. Kroz sistematsku analizu tehničkih mehanizama od Bitcoin pseudoanonimnosti i privacy coins, do DeFi protokola i cross-chain hopping tehnika, rad mapira evoluciju kriptovalutnog pranja novca od primitivnih jednokratnih transakcija prema sofisticiranim, višeslojnim operacijama koje kombinuju tehnološku sofisticiranost s institucionalnim ranjivostima globalnog regulatornog mozaika. Posebna analitička pažnja posvećena je slučajevima koji demonstriraju konvergenciju kriptokriminala s državnom strategijom, tj. ransomware koji funkcionišu kao paraziti na globalnoj digitalnoj ekonomiji, DeFi eksploatacijama koje u minutama dreniraju stotine miliona dolara, i sjevernokorejskim državno-sponzorisanim hakerskim operacijama koje finansiraju zabranjene oružane programe pod sankcijama. Rad evaluira regulatorne odgovore poput MiCA, FATF Travel Rule i OFAC sankcije, te identifikuje sistemske praznine koje ostavljaju DeFi i peer-to-peer sistem izvan efektivne regulatorne kontrole. Zaključak poziva na fundamentalnu promjenu paradigme regulatornog pristupa, i to od retrospektivne forenzike prema prospektivnoj arhitekturi transparentnosti koja mora biti ugrađena u same protokole.
Abstract - The rise of digital technology has led to an increase in cybercrime. This has made the management of digital forensic evidence more complicated. Traditional evidence management systems utilize manual methods and centralized databases. Methods like these are vulnerable to data tampering, unauthorized access, and human error. These issues threaten the integrity of the evidence and the chain of custody during the investigation process. In this paper, we introduce a system that utilizes blockchain technology, smart contracts, and a decentralized system for the tracking of forensic evidence. Security and transparency will be guaranteed. In our system, evidence records are stored as ERC-721 Non-Fungible Tokens. A private Ethereum blockchain was developed using Ganache and combined with wallet-based authentication and Role-Based Access Control to ensure that only authorized personnel have the ability to view and manage evidence. Smart contracts facilitate the registration, verification, transfer, and auditing of evidence, thus, considerably reducing the manual work and greatly increasing the trustworthiness of the system. We proposed a hybrid system of storage whereby evidence and its forensic files are stored off chain, and the evidence metadata and its forensic files are stored on chain. This paper presents the design and architecture of the system,implementation and evaluation are in progress.Our system will be a trusted, efficient, and effective system of evidence management.
The rapid digitalization of financial services has transformed the global financial ecosystem, enabling faster transactions, enhanced customer experiences, and greater financial inclusion. However, this digital transformation has simultaneously increased the complexity, scale, and sophistication of financial fraud. Traditional rule-based fraud detection systems often struggle to identify evolving fraud patterns, resulting in delayed responses, increased false positives, and substantial financial losses. Artificial Intelligence (AI)-powered real-time fraud monitoring systems have emerged as a transformative solution capable of detecting suspicious activities instantly through advanced data analytics, machine learning, deep learning, natural language processing, and behavioral intelligence. These systems continuously analyze vast volumes of transactional and non-transactional data, enabling financial institutions to identify anomalies, predict fraudulent behavior, and automate risk management processes with unprecedented accuracy and speed. This literature review examines the evolution, applications, technological foundations, benefits, challenges, and future directions of AI-powered real-time fraud monitoring systems in modern financial services. The review highlights how AI enhances fraud detection capabilities across banking, payment systems, insurance, digital wallets, cryptocurrencies, and investment platforms while discussing critical concerns related to privacy, algorithmic bias, explainability, cybersecurity, and regulatory compliance. The findings demonstrate that AI-driven fraud monitoring represents a fundamental component of modern financial security infrastructure and will continue to shape the future of fraud prevention in increasingly digital financial environments.
The widespread problem of cyberbullying in today’s digital environment is made worse by the quick spread of IoT devices and the difficulties in organizing and protecting digital evidence. Traditional forensic methods are often inadequate due to their inability to provide a tamper-proof chain-of-custody and their limited scalability under high data loads. To overcome these constraints, our work makes use of innovative technologies such as a permissioned blockchain (Hyperledger Fabric), powerful encryption methods (AES-256 and RSA), and decentralized off-chain storage (IPFS). We propose an integrated, blockchain-driven forensic evidence collection framework that ensures secure, real-time evidence acquisition from diverse IoT devices, automated validation via smart contracts, and efficient, Role-Based Access Control for evidence retrieval. A hybrid consensus mechanism, combining elements of PBFT and Proof-of-Stake, enhances the system’s security and scalability while reducing processing latency and energy consumption. Experimental results demonstrate that our approach achieves high throughput and low latency, making it a strong and reliable solution for forensic investigations in cyberbullying cases. Within our experimental scope, the framework strengthens the integrity and authenticity of digital evidence and addresses key regulatory considerations, though real-world validation remains future work.
With the rapid advancement of decentralized finance (DeFi), security incidents related to cryptocurrency have become increasingly prevalent. After such incidents, attackers typically attempt to rapidly move stolen assets, concealing the origin of illicit funds and ultimately converting them into fiat currency. However, existing anti-money laundering (AML) methods struggle to cope with the semantic complexity of DeFi transactions. They either rely heavily on low-level token transfers, or perform protocol-agnostic money flow analysis, failing to capture the high-level intent of transactions. In this paper, we propose AMLGuard, a semantic-aware AML framework for account-based blockchains. AMLGuard tracks illicit fund flows from known malicious addresses by performing semantic analysis on complex DeFi transactions, enabling accurate and continuous laundering tracking. Given a complex transaction, AMLGuard combines static rule-based analysis with retrieval-augmented large language model (LLM) reasoning to infer implicit DeFi semantics, transforming raw transaction data into high-level semantic representations. Furthermore, for cross-chain transactions where laundering intent is not explicitly exposed, AMLGuard parses transaction parameters and performs argument parsing to recover cross-chain semantics, enabling seamless tracking across ledgers. Based on the inferred semantics, AMLGuard abstracts each transaction into a DeFi Semantic Unit (DSU). We evaluate the effectiveness of AMLGuard on 82 real-world laundering cases, involving illicit assets worth over $1 billion. Specifically, AMLGuard reconstructs compact illicit fund-flow topologies with destination precision of 94.4% and 87.6%, while achieving the highest address recall of 98.4% and 95.8% and destination recall of 94.1% and 93.8% on single-chain and cross-chain datasets.
Similar to all other cryptocurrency platforms, Ethereum is constantly confronted with malicious activities. In recent years, research efforts have targeted the detection and mitigation of malicious activities and the associated accounts within the Ethereum ecosystem. Yet, the malicious accounts represent only a small visible part of the substantial collaborative network enabling these activities. In this work, we offer the first analysis of this collaborative network and the corresponding affiliate accounts that often remain hidden from detection. We present enEtherShield, an enhanced framework for detecting affiliate accounts that assist malicious accounts in the related Ethereum scams. Our research findings lay the foundation for the detection of the collaborative network enabling Ethereum scams.
This chapter explores the role of blockchain and cryptocurrency forensics in investigating Darknet-enabled cybercrime. Cryptocurrencies such as Bitcoin and privacy-focused coins are widely used in Darknet marketplaces because they support pseudonymous transactions that complicate tracing and attribution. The chapter examines forensic techniques for blockchain analysis, including address clustering, transaction graph analysis, and heuristic-based tracing. It also explains how illicit financial flows are concealed through mixers, tumblers, and chain-hopping strategies. In addition, the chapter reviews analytics tools used by law enforcement and cybersecurity professionals to detect suspicious patterns and link wallets to entities. Challenges related to privacy-enhancing cryptocurrencies, blockchain scalability, and legal considerations are discussed. Finally, emerging threats involving decentralized finance (DeFi) and cross-chain transactions are explored to provide researchers, forensic analysts, and policymakers with insights into illicit financial activity in the Darknet ecosystem.
The rapid expansion of U.S. financial technology platforms has created new vectors for money laundering, terrorist financing and financial crime that traditional anti-money laundering frameworks were not designed to address. This article presents a systematic literature review of 78 peer-reviewed studies published between 2015 and 2025 to examine the design, performance and policy implications of advanced anti-money laundering frameworks for U.S. fintech platforms. This study draws on evidence from financial criminology, regulatory law, computer science and organizational studies; the review finds that machine learning-based transaction monitoring systems reduce false positive alert rates by 40 to 70 percent compared to rule-based systems, as well as improving detection of sophisticated layering schemes. Blockchain analytics tools partially de-anonymize cryptocurrency transaction flows and have been used to identify illicit financial activity on major blockchain networks. Regulatory technology platforms automate suspicious activity reporting, beneficial ownership identification and customer due diligence workflows in ways that reduce compliance costs as well as improve regulatory data quality. However, the reviewed literature also documents persistent challenges, including algorithmic disparate impact in AML monitoring systems, beneficial ownership opacity through shell company structures, regulatory arbitrage between licensed exchanges and decentralized finance protocols and the systemic underutilization of suspicious activity report intelligence by law enforcement agencies. The article concludes with six evidence-based policy recommendations and a research agenda for advancing AML framework effectiveness in the rapidly evolving U.S. fintech sector. Keywords: Anti-Money Laundering, Fintech, AML Compliance, Machine Learning, Transaction Monitoring, Know Your Customer, Cryptocurrency Regulation, Regulatory Technology, Suspicious Activity Reporting, Financial Crime.
Decentralized Finance (DeFi) has suffered over $5 billion in cumulative losses from security incidents, yet the academic community lacks a large-scale, multi-source-verified dataset to systematically characterize these threats. We present DEFIHACK-824, a curated dataset of 823 DeFi security incidents spanning 2017 to 2026, cross-validated against three independent intelligence sources (Rekt News, SlowMist, and CertiK). Each record is annotated with attack category, confidence level (Gossip/Classified/Ground Truth), and estimated financial loss. We classify incidents into 14 attack categories and conduct statistical analyses: (1) flash-loan-enabled price manipulation and reentrancy together account for 51.5% of all attacks; (2) a chi-squared test rejects the null hypothesis of uniform category distribution at p < 0.0001 (chi-squared = 1,273.2, df = 13); (3) despite widespread deployment of automated detection tools, the annual attack count has not monotonically decreased. We further propose a six-layer DeFi threat model and quantify the effectiveness of four defense classes. The dataset, threat model, and 50 categorized Solidity vulnerability patterns are released under the MIT license.
This chapter examines the dual nature of virtual currencies. It mainly focuses on Bitcoin’s role in both financial innovation and illicit finance. This chapter analyzes the core mechanisms of anonymity and decentralization that make cryptocurrencies attractive to criminal activity. It was exemplified in the landmark Silk Road darknet marketplace case. The discussion traces the evolving regulatory response, from initial enforcement actions to the development of structured frameworks such as the GENIUS Act for stablecoins and the CLARITY Act for digital asset market classification. Further analysis covers the application of traditional securities and commodities laws to decentralized finance (DeFi). The MNGO Markets illustrated its exploitation case. The discussion centers around two blockchain applications: cross-border payments and the creation of immutable smart contracts to comply with General Data Protection Regulation (GDPR). This chapter concludes that cryptocurrencies exist as a dual-purpose technology. The system requires a sophisticated regulatory approach that lowers both financial crime risks and market integrity threats while preserving the potential for technological innovation.
Abstract The same infrastructures that enable decentralised finance, NFT markets, and metaverse platforms also create new spaces for para‑crime. This article extends grey criminology to Web3 by applying three mechanisms of infrastructural illegality – parasitism, normative greyness, and platform co‑production – first developed for physical cross‑border grey economies (daigou). Drawing on technical and financial crime literature, we show how smart contracts, stablecoins, and DAO governance are parasitised for money laundering and fraud; how techno‑libertarian narratives of 'code is law' and decentralisation sustain normative greyness; and how algorithmic security and DAO co‑production reshape rather than eliminate para‑crime. The analysis reveals both structural parallels with physical grey economies and domain‑specific variations – most notably, the deeper internalisation of co‑production in code‑based systems. We argue that grey criminology must extend its infrastructural turn to virtual and metaversal spaces, and that enforcement paradoxes – where suppression threatens valued infrastructures – apply as much to blockchain protocols as to customs thresholds.
Ravindran Kandasamy, Chandan Chavadi, H. Chittoo, Nidhi Shukla
Online commerce, despite its infinite development possibilities, now raises the specter of global security. A huge amount of personal data is at risk from cyberattacks, such as hacking and identity theft, that harm companies and consumers alike. The traditional way of keeping everything in one place leads to unauthorized access and manipulation, thus requiring stronger security measures. The same decentralized, unbreakable encryption and immutable record keeping that give these barter platforms strong protection against fraud are also features of distributed ledger technology. Decentralization removed control from one single source, making it less likely that there will be any tampering and deception will become slim. Blockchain networks featuring “smart contracts” that make the terms of a deal transparent and enforce contracts without the need for go-betweens. This chapter provides an analysis of how the blockchain can enhance e-privacy in e-commerce, with a focus on the foundations and attributes of blockchain to overcome current threats. As the technology becomes widespread, real cases are proving to revolutionize data security. New Use Cases And Research Using Distributed Ledgers For Enhanced Security.
Bitcoin (BTC) wealth distribution is often studied with macro indicators like wallet balances, prices, network activity, fees, and hashrate. This letter proposes a "Crypto-Microeconomic Observability Framework" to examine micro-level Bitcoin wealth disparities across five labeled agent classes: Service, Abuse, Malware, Individuals, and Benign. Using descriptive, inequality, and longitudinal concentration metrics, we show that Bitcoin wealth is highly concentrated across major classes, consistent with a persistent "Whale-Effect". Service entities hold the largest share of observed BTC (75.15%), while Abuse controls a disproportionately large share relative to its entity count (24.26% of BTC vs. 3.53% of entities). Individuals, Abuse, and Service show near-maximal within-class inequality (e.g., Gini = 0.9993 for Individuals), and time-series analysis indicates these patterns persist. Overall, Bitcoin wealth among labeled economic agents remains structurally uneven and concentrated in a small subset of entities.
Since the first implementation of a blockchain with Bitcoin in 2009, cryptoassets created and transacted using blockchain technologies have grown and diversified significantly. Because regulatory regimes, which govern cryptoassets, do not have global coverage, criminal actors find opportunities to commit cryptoasset fraud. While it can be difficult to distinguish between cryptoassets that are honest but high risk and cryptoassets that are outright fraudulent, investors seeking significant returns frequently invest in unregulated cryptoassets, namely cryptocurrencies and non-fungible tokens (NFTs). This study provides a crime script analysis to examine the chronological and functional steps offenders use to execute cryptoasset fraud. It considers three types of crypto asset fraud and how they have functioned over time: Ponzi schemes, cryptoasset exit scams, such as cryptocurrency “rug pulls,” and NFT “mint-and-run” schemes, where invested value is stolen from a crypto asset project. By outlining the fundamental crime script of cryptoasset fraud, this study considers the implications for regulators. Of note, this study shows that while the stages of cryptoasset frauds are consistent, the speed at which frauds are executed has, on average, increased significantly. This rapidity of execution provides enduring challenges to regulators, who often cannot respond quickly. This challenge must be considered if regulation is to be effective.
Elena Baninemeh, Marre Slikker, Katsiaryna Labunets, Slinger Jansen
Purpose This study aims to investigate the impact of cybersecurity vulnerabilities on the effective implementation of distributed ledger technologies (DLTs), addressing a critical gap in the existing literature. This research seeks new insights into the detection and mitigation of specific attacks, such as selfish mining and Sybil attacks, contributing to a deeper understanding of cybersecurity risk assessment in DLT applications. Design/methodology/approach This study uses a mixed-methods approach, using a literature review combined with method engineering. Data were collected from an extensive database of known security threats, documented attacks on DLTs and associated countermeasures. The proposed method was evaluated through three case studies, with each organization applying the security risk assessment method developed in this study. Findings The results of this study reveal that the proposed security risk assessment method effectively identifies and addresses cybersecurity threats specific to distributed ledger applications. Case studies demonstrate that the method enables organizations to systematically evaluate and mitigate risks, offering evidence that comprehensive countermeasures can significantly enhance security. These findings confirm the practicality of the proposed method and reveal new patterns in organizational responses to cybersecurity threats in distributed ledger environments. Originality/value This research offers a novel perspective on the intersection of cybersecurity and DLTs, providing valuable insights into risk assessment frameworks tailored for this domain. This study’s findings contribute to the advancement of cybersecurity practices in distributed ledger applications, highlighting critical areas for future research and practical guidelines for organizations aiming to enhance their cybersecurity posture.
Blockchain technology is a groundbreaking decentralized electronic registry that captures transactions and data on a network of computers in an insecure, transparent and tamper-proof context. At its most fundamental level, blockchain systematizes the information framed into blocks and each block includes a list of transactions or documents, a timestamp and a cryptographical hash connecting it to the last block creating an immutable chronological chain. In contrast with the conventional and centralized databases, which are managed by one party, blockchain runs on a distributed system of nodes where each one of them keeps an identical copy of the registry. This architecture ensures elimination of single points of failure and improves on the use of intermediaries. Consensus mechanisms, like Proof-of-Work or Proof-of-Stake, are used to authenticate transactions and provide agreement among participants prior to the addition of new blocks. This chapter explores the use of blockchain technologies in scientific criminal investigations.
This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by rekt.news, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative losses yet represent a negligible share of published audit findings. Third, realised losses exhibit extreme concentration: the eight largest incidents account for 50.6% of cumulative dollar losses and the twenty largest for 71.4%, a distributional shape inconsistent with Gaussian assumptions. Throughout, we adopt the analytical convention that audit outputs and exploit outputs describe different populations and present the two datasets in parallel rather than as directly comparable samples.
Yuanyuan Zhang, N. J. Lord, Stephen Chan, Jeffrey Chu · 5 authors
This study examines the relationship between global phishing crime and cryptocurrency-market conditions, with a specific focus on Ethereum. Using monthly data from January 2016 to December 2022, we analyse the returns of global phishing crime numbers together with six Ethereum financial metrics relating to transactions, trading volume, and price impact. We employ quantile regression, quantile-on-quantile regression, and Granger causality in quantiles to examine whether the relationship between Ethereum market indicators and phishing activity varies across different market states. The results reveal a state-dependent relationship. Large increases in phishing crime numbers are strongly associated with large increases in Ethereum transaction activity, average transaction price, and transaction quantity, while implicit transaction cost is predominantly negatively associated with phishing activity, particularly at the upper quantiles. These findings suggest that phishing risk is most pronounced during extreme market conditions and may be shaped by both reward-enhancing market activity and cost-enhancing transaction frictions. To interpret these patterns, we develop an incentive-based criminogenic mechanism in which Ethereum market conditions affect phishing activity through offenders’ expected payoff. We identify two mediating channels: a monetisation-frictions channel, operating through liquidity, price impact, slippage, and transaction costs; and an attention/information-asymmetry channel, operating through volatility, speculative attention, fear of missing out, and user vulnerability. The findings provide initial evidence that cryptocurrency-related phishing is not only a technical cybersecurity issue, but also a market-sensitive phenomenon shaped by financial incentives, liquidity conditions, and behavioural vulnerability. These insights can support regulators, law enforcement agencies, and cryptocurrency platforms in developing adaptive early-warning and prevention strategies.