Blockchain Papers

Santosh S Doifode, Anand Singh Rajawat

No abstract is available for this record.

S. Lakshmi

Persuasive textual narratives, bogus visual evidence, disreputable update patterns and absent accountability systems are being increasingly used to deceive backers in fraudulent crowdfunding campaigns. Current fraud detection techniques are primarily based on static information, on text-only indicators, or on very shallow fusion of multimodal information, and they are not able to detect deceptive information that evolves over time or is inconsistent across different modalities. This study presents a Temporal Cross-Modal Trust Intelligence Framework to mitigate reward-based crowdfunding fraud that is explainable. The framework combines Hidden Method-of-Moments Markov modelling for latent temporal behaviour analysis, Polynomial Expansion Canonical Correlation Analysis for nonlinear text–image consistency evaluation and a Frequency-Gated GRU classifier to distinguish subtle drift in behaviour from sudden suspicious behaviour anomalies. Local Outlier Factor-based risk refinement is also added to detect rare and locally abnormal fraud patterns, and a blockchain-auditable layer ensures prediction outcomes are transparent and tamper-proof, enhancing the decision-making process. Experimental results on a multimodal crowdfunding dataset created from the Kickstarter platform show that the proposed model achieves better accuracy, recall, F1-score, ROC-AUC, PR-AUC, and calibration reliability than conventional multimodal, transformer-based, and recurrent neural network models and classical machine learning. The results validate the proposed solution, which is built on the four temporal dynamics, cross-modal consistency, anomaly refinement and auditability, to be a comprehensive and interpretable solution for detecting early crowdfunding fraud.

Bharath M B, Latha N R

Web security has become a critical domain as modern applications increasingly rely on dynamic user-generated content, making them highly vulnerable to Cross-Site Scripting (XSS) attacks. Traditional detection systems struggle to cope with evolving payload patterns, limited generalisation across institutions, and strict privacy restrictions that prevent sharing of sensitive request logs. To address these challenges, this work proposes a Zero-Knowledge Federated Sequence Learning (ZK-FSL) framework that enables collaborative XSS detection without exposing raw data or intermediate gradients. The model integrates attention-based deep sequence learning with zero-knowledge proof validation, ensuring both strong predictive capability and verifiable trust among participating clients. Experimental evaluation demonstrates that ZK-FSL achieves superior performance compared to centralised and federated baselines, reaching 96.3% accuracy , 96.7% precision , 95.9% recall , 96.3% F1-score , and an AUC of 0.98 . These results confirm that the proposed framework effectively enhances privacy-preserving threat detection while maintaining high robustness against diverse and sophisticated XSS attack patterns.

Michał Bartnicki, Jarosław A. Chudziak

Sybil attackers are Blockchain actors that adopt the characteristics of regular users to exploit airdrops or influence governance. Current methods of Sybil actor detection include constructing graphs, which requires token transfers between examined wallets. Machine learning algorithms have been employed as well, but they treat the task as a closed-set classification problem, making them vulnerable to frequent changes in attack strategies or evasion tactics. We address the following questions: can compression-based similarity differentiate Sybil bots, organic users, and arbitrage bot wallets without direct financial links? What is the effect of high-signal contracts on the discovery of Sybils, and how robust are behavioral graphs under temporal drift and adversarial perturbations? Our approach synthesizes a symbolic Transaction Grammar from EVM (Ethereum Virtual Machine) traces, capturing separately transaction rhythm, execution structure, and functional intent. The high-signal contracts are filtered with our own protocol, called the Blind-Spot Protocol. Gzip-based NCD is used to construct a behavioral graph for Sybil discovery. We validate this framework against supervised machine learning baselines, a temporal split, and synthetic camouflage stress tests. Ultimately, we contribute a leakage-aware behavioral framework for Sybil candidate discovery. Its core NCD primitive requires no supervised training and can expand suspicious seed wallets without explicit funding links. We position the method as a training-free local discovery primitive for open-world blockchain audits, rather than as a formal open-set recognition system.

Shengyu Chen, Hui Zhang, Junhuan Zhang

Abstract Sybil attacks are a significant challenge in permissionless blockchains. However, existing research pays limited attention to how different modes of network evolution affect Sybil resistance. In practice, the method of node admission can greatly influence a blockchain’s resilience to Sybil attacks. To address this, we study Sybil resilience using a dynamic network growth model based on preferential attachment and adopt the Identity-Augmented Proof-of-Stake (IdAPoS) protocol as our consensus backbone. First, we extend IdAPoS with an on-chain Sybil-detection mechanism, reducing reliance on off-chain honesty assumptions. Subsequently, we formalize the network expansion procedure in IdAPoS by distinguishing the Applicant-based and Participant-based Network Expansion Models and assessing Sybil resistance under each model. Finally, using agent-based modeling, we simulate voting token value dynamics under Sybil attacks to quantify how expansion strategies affect Sybil resistance. Experiments show that our proposed trustworthiness-evaluation mechanism removes IdAPoS’s reliance on off-chain honesty information by extracting node-level Sybil-suspicion scores from on-chain voting relationships. Sybil attacks in blockchains cannot be eliminated but can only be delayed. Greater centralization among honest nodes generally strengthens Sybil resistance. Under superlinear network growth, the Participant-based Network Expansion Model achieves more stable scaling than the Applicant-based Network Expansion Model. Overall, IdAPoS improves system-level Sybil resilience at the cost of more centralized voting power.

Carter James

The pseudonymous nature of blockchain transactions, combined with the rise of encrypted DNS protocols such as DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT), has created a new frontier for sophisticated tax evasion. Malicious actors can now exfiltrate transaction details and coordinate transfers by encoding data within the payloads of encrypted DNS queries, effectively bypassing traditional network monitoring and forensic analysis. This paper proposes a novel detection framework that leverages a hybrid deep learning architecture to identify such covert, tax-evading activities. Our system integrates a Convolutional Neural Network (CNN) for its superior ability to extract spatial and sequential patterns from raw network flow data and encrypted payload characteristics, with a Long Short-Term Memory (LSTM) network to model the temporal dynamics of blockchain interactions and DNS query sequences. By fusing these two paradigms, the hybrid model can distinguish between benign encrypted DNS traffic and malicious payloads used for illicit financial coordination. We evaluate our framework using a synthetically generated dataset that simulates realistic tax-evasion strategies, including micro-transaction splitting and delayed transaction relaying. Preliminary results indicate that our approach achieves a significantly higher detection rate and lower false-positive rate compared to conventional signature-based or single-model machine learning methods. This research demonstrates the efficacy of hybrid neural networks in preserving financial integrity and provides a critical tool for regulatory agencies to enforce tax compliance in the age of encrypted communications and decentralized finance.

Chao Li, Mingxu Chen, Chunmei Jiang, R C Liu · 7 authors

No abstract is available for this record.

Bofeng Pan, Andrei Natadze, Enrico Branca, Jadyn Kimber · 5 authors

Similar to all other cryptocurrency platforms, Ethereum is constantly confronted with malicious activities. In recent years, research efforts have targeted the detection and mitigation of malicious activities and the associated accounts within the Ethereum ecosystem. Yet, the malicious accounts represent only a small visible part of the substantial collaborative network enabling these activities. In this work, we offer the first analysis of this collaborative network and the corresponding affiliate accounts that often remain hidden from detection. We present enEtherShield, an enhanced framework for detecting affiliate accounts that assist malicious accounts in the related Ethereum scams. Our research findings lay the foundation for the detection of the collaborative network enabling Ethereum scams.

Yifan Jia, Ye Tian, Liguo Zhang, Yanbin Wang · 7 authors

No abstract is available for this record.

Chiquan Chen, Ahmed Zahir, Ubaidhullah Abdul Hameed

No abstract is available for this record.

Z C Zhao, J X

No abstract is available for this record.

Changhao Wu, Junwei Xu, Yi-Xiang Wang, Wenke Zhu · 6 authors

No abstract is available for this record.

Can Li, Yafei Zhang, Runshuo Liu, Zhongying Zhao · 6 authors

No abstract is available for this record.

Y Jin, Shuohan Wu, Chong Chen, Lingfeng Bao · 6 authors

The Internet is transitioning from Web3 toward Web4, where autonomous agents serve as independent economic actors. These agents can now hold crypto wallets, execute on-chain trades, and pay for external API calls. This transition calls for a new infrastructure stack capable of supporting key agent operations, including agent-to-tool interaction, agent-to-agent payments, and verifiable agent identity, represented by emerging protocols such as the Model Context Protocol, x402, and EIP-8004. Despite growing industrial interest in these protocols, the real-world Web4 agent ecosystem remains largely underexplored. To bridge this gap, we conduct the first large-scale empirical study of the Web4 ecosystem. Specifically, our study targets three interconnected questions: how Web4 agents are deployed and used in practice; what engineering challenges developers face when building Web4 agents; how current project communities respond to these challenges. To answer these questions, we analyze 99,448 multi-chain identity registrations, 317,596,323 transaction logs, the source code of 341 MCP projects, and 349 filtered GitHub issues. Our findings reveal that autonomous agents have established a highly active machine-to-machine payment economy, processing millions of daily transactions. However, this growth is built on immature infrastructure, including identity/authorization practice, cross-environment operation, and payment interoperability. Our follow-up analysis shows that community responses are visible but unevenly distributed across repositories, and payment interoperability remains the most persistent unresolved bottleneck. Overall, this study reveals a critical gap between the rapid growth of the Web4 agent economy and its fragile underlying infrastructure, highlighting future directions for building a more secure Web4 agent ecosystem.

Ramya K, Anbu Karuppusamy Dr S, Ragunathan Dr Aravindhan

The internet has become integral to daily life, facilitating commerce, communication, and services; however, it also presents significant security vulnerabilities. I have been looking at 2025 online security, accumulating patterns both popular and non-popular until March. AI plays a critical role in identifying security threats in real time. However, it also empowers malicious actors to orchestrate more sophisticated attacks, it's also but it also empowers malicious actors to orchestrate sophisticated cyberattacks. Another major issue is Zero trust architecture, which aligns with decentralized and remote environments, it's all about not believing anyone until they prove it. Web3 comes next, a free-for-all paradise where decentralization seems great until you run across issues—hacks are plentiful. The worst things? ransomware that keeps individuals from using the internet, outdated injection methods, IoT trash that basically gives crooks access. People aren't just sitting there, though; cloud trickery and privacy breaches are fighting the war and keeping momentum. Still, it's a fight with absurd costs, inadequate help, and thieves always changing the goalposts. Remarkable, isn't it? Innovations such as prospective quantum shielding and self-repairing technologies intrigue me. I am presenting my findings regarding our current situation, the factors contributing to our failures, and potential solutions for overcoming these challenges—not a traditional lecture This paper presents a comprehensive synthesis of the author’s research and analysis aimed at enhancing internet resilience in 2025.

Lois-Kleinner Alpasan

Self-sovereign identity (SSI) represents a paradigm shift in digital authentication, transferring control from centralized identity providers to individual users (Mühle et al., 2018). This paper presents the Kathon Vault identity system, which implements self-sovereign browser identity through BIP39 mnemonic seed phrases (Palatinus et al., 2013) for Ed25519 hierarchical deterministic (HD) key generation (Bernstein et al., 2012; Wuille, 2012). The system generates a master seed from a BIP39 mnemonic (12, 18, or 24 words with configurable passphrase), derives Ed25519 keypairs through the SLIP-10 key derivation scheme (Přikryl, 2022), and enables zero-knowledge authentication across websites through a novel browser-native WebAuthn-hybrid protocol. We demonstrate that the BIP39-derived Ed25519 keys provide equivalent security to standard FIDO2/WebAuthn authenticators (316 bits of entropy for 24-word phrases) while offering three critical advantages: (1) deterministic key recovery from the mnemonic phrase alone, (2) hierarchical key organization matching the SLIP-44 registered coin type for Kathon, and (3) cryptographic privacy through zero-knowledge proofs that enable selective attribute disclosure without revealing the master public key. In a security analysis against brute-force, dictionary, side-channel, and social engineering attacks, the system achieves resistance levels exceeding NIST SP 800-63B Level 4 authentication assurance requirements (NIST, 2020). A usability study with 48 participants demonstrates that BIP39-based authentication achieves 96% successful login rates with 14% lower task completion time compared to password manager-based workflows. This work establishes mnemonic-based HD key generation as a viable and superior alternative to federated identity providers for browser-based authentication. --- Part of The Anticloud research corpus by Lois-Kleinner Alpasan (ORCID: 0009-0009-2233-6107). This work explores browser engine, privacy in the context of sovereign AI infrastructure, post-cloud computing architectures, and transparent, blackbox-free systems.

Mukhtar Muhammad Abdulrazaq

This is an independent research project with publicly released, reproducible code (not a peer-reviewed publication). We ask which class of behavioural signal drives machine-learning detection of fraudulent Ethereum accounts: graph, transaction (value/volume), or temporal (timing) features, on 9,307 labelled accounts. Crucially we distinguish degree-count graph features from true graph-topology features (PageRank, k-core, clustering, degree centrality) reconstructed from a 242,518-node, 1.65M-edge transaction graph. Transaction-value features are the strongest single class (PR-AUC 0.93), but true graph-topology significantly outperforms degree counts (PR-AUC 0.84 vs 0.70, p<1e-6) and adds the most on top of transaction features; PageRank is the single most informative feature. The topology result survives a time-respecting leakage audit (features rebuilt from each account's earliest 70% of transactions). All code, data pointers, figures, and tests are released.

Stefan Beyer

This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by rekt.news, representing aggregate losses of approximately US$7.76 billion. We report three central findings. First, the distribution of audit findings (by severity, category, and technology stack) is substantially stable across the observation window, with the Critical-plus-High share remaining within a 15-17% band in every complete year. Second, the categorical distribution of realised exploit losses does not correspond to the categorical distribution of audit findings: private-key compromise, phishing, and social-engineering vectors account for approximately 49.6% of cumulative losses yet represent a negligible share of published audit findings. Third, realised losses exhibit extreme concentration: the eight largest incidents account for 50.6% of cumulative dollar losses and the twenty largest for 71.4%, a distributional shape inconsistent with Gaussian assumptions. Throughout, we adopt the analytical convention that audit outputs and exploit outputs describe different populations and present the two datasets in parallel rather than as directly comparable samples.

Yuanyuan Zhang, N. J. Lord, Stephen Chan, Jeffrey Chu · 5 authors

This study examines the relationship between global phishing crime and cryptocurrency-market conditions, with a specific focus on Ethereum. Using monthly data from January 2016 to December 2022, we analyse the returns of global phishing crime numbers together with six Ethereum financial metrics relating to transactions, trading volume, and price impact. We employ quantile regression, quantile-on-quantile regression, and Granger causality in quantiles to examine whether the relationship between Ethereum market indicators and phishing activity varies across different market states. The results reveal a state-dependent relationship. Large increases in phishing crime numbers are strongly associated with large increases in Ethereum transaction activity, average transaction price, and transaction quantity, while implicit transaction cost is predominantly negatively associated with phishing activity, particularly at the upper quantiles. These findings suggest that phishing risk is most pronounced during extreme market conditions and may be shaped by both reward-enhancing market activity and cost-enhancing transaction frictions. To interpret these patterns, we develop an incentive-based criminogenic mechanism in which Ethereum market conditions affect phishing activity through offenders’ expected payoff. We identify two mediating channels: a monetisation-frictions channel, operating through liquidity, price impact, slippage, and transaction costs; and an attention/information-asymmetry channel, operating through volatility, speculative attention, fear of missing out, and user vulnerability. The findings provide initial evidence that cryptocurrency-related phishing is not only a technical cybersecurity issue, but also a market-sensitive phenomenon shaped by financial incentives, liquidity conditions, and behavioural vulnerability. These insights can support regulators, law enforcement agencies, and cryptocurrency platforms in developing adaptive early-warning and prevention strategies.

Veeraragavan. K, E.Venugopal, T. C. Karthikheyan

No abstract is available for this record.

Andrew Stewart Caldin

Q8 Compression Breakthrough — Cluster 110 of 240 E8 root vectors. Compression ratio: 0.425 (threshold: 0.38) Cluster size: 3 discoveries Domain: geometry E8 root vector bucket: 110/240 Source discoveries: - E8 Term: ethereum - E8 Term: ethereum - E8 Term: fundementals Author: Andrew Stewart Caldin, Independent Researcher, UK. Part of the E8 Intelligence Research series. Platform: e8intelligence.com

Shikah J. Alsunaidi, Hamoud Aljamaan

Ethereum is a widely adopted blockchain platform that supports a large number of decentralized applications. Despite its rapid growth, Ethereum remains vulnerable to security threats, particularly phishing attacks that exploit transactional behavior. This study investigates the effectiveness of tree-based ensemble learning models for detecting phishing transactions on the Ethereum network using an imbalanced transaction dataset. Seven tree-based ensemble classifiers are empirically evaluated under a cost-sensitive learning framework, with performance assessed using the Matthews Correlation Coefficient (MCC) as the primary metric. The results show that boosting-based ensembles substantially outperform bagging-based approaches and a single decision tree. In particular, Gradient Boosting achieves the strongest detection performance with an MCC of 0.9742, while CatBoost provides a trade-off between detection performance and computational efficiency, achieving competitive detection accuracy with the lowest average inference time (approximately 1.54 µs per transaction). The findings demonstrate that accurate and robust phishing detection can be achieved using a compact feature representation, enabling practical deployment with reduced computational overhead.

Assal Aminian, Zining Wang

Cryptocurrency fraud on blockchain platforms continues to cause substantial financial losses, creating an urgent need for detection systems that are not only accurate but also interpretable for operational and regulatory use. In this paper, we propose an explainable framework for Ethereum fraud detection integrating an XGBoost ensemble with TreeSHAP. This system achieves high predictive performance (96.3% F1-score, 96.6% recall) while providing model-level transparency via an interactive chatbot interface. Evaluation using fidelity and stability metrics confirms the reliability of the SHAP-based insights, while user-role simulations demonstrate that our structured delivery enhances clarity and actionability over standard visualizations. This work offers a practical, transparent foundation for deploying robust AI in high-risk financial environments without sacrificing accuracy.

Chuyi Yan, Yinhao Qi, Xueying Han, Junrong Liu · 8 authors

The burgeoning prevalence of Ethereum phishing behavior has iCSUR-2025-0155mposed substantial constraints on the advancement of blockchain finance, resulting in losses of more than $7.7 billion to date, so it is urgent to detect it in time. Currently, available detection methods usually focus on the spatial features within transaction graphs. These methods often employ shallow mining techniques on small samples. As a result, they may overlook certain aspects of interaction patterns, such as temporal behavior. Additionally, their data mining capability is limited due to the small sample sizes. In this study, we propose a graph contrastive learning framework to enrich features of accounts behavior patterns with restricted samples to overcome these limitations. Firstly, we construct an Ethereum interaction graph with the multi-graph involving more temporal information centered with labeled nodes and lighten it with our strategy. Secondly, to comprehensively characterize the accounts pattern, we design the encoder part with the GAT-LSTM model based on attention mechanism fusing statistical features , fine-grained temporal behavioral features and graph structural semantic features . Thirdly, to moderate the sparsity of phishing nodes, we employ data augmentation and contrastive learning to fully mine sparse node information. Moreover, we carried out an in-depth experimental evaluation. The CMD-EPD approach, boasting an F 1 -score of 0.87, outperformed all comparison methods. We also executed a thorough case study to analyze phishing accounts phenomenological indicators which back up the superiority of our framework.