In recent years, blockchain technology has developed rapidly and received widespread attention. However, its pseudonymous and decentralized nature has also attracted many criminal activities. Ponzi schemes, a kind of classic financial scam, also hide their true face in smart contracts, causing massive financial losses to blockchain users. Although several methods have been proposed to detect Ponzi contracts, there are still limitations in broad applicability, semantics understanding, and adversarial robustness. In this article, we propose PonziHunter, an intelligent framework for hunting Ponzi contracts on Ethereum. To tackle the problem of broad applicability, we train a detection model that does not require expert experience based on publicly available on-chain bytecode and off-chain contract labels. To tackle the problem of semantics understanding, we employ cross-function control flows and state variable dependencies to understand the logic of Ponzi contracts. Specifically, we decompile bytecodes into higher-order representations to analyze control flows and state variable dependencies and model the information as graph data. By combining the idea of code slicing, we identify the basic blocks related to Ponzi contract recognition. To tackle the problem of adversarial robustness, we model Ponzi contract recognition as a graph classification problem based on contrastive pre-training. We propose a data augmentation method for control flow graphs (CFGs), which preserves the basic blocks related to Ponzi contract recognition as much as possible during data perturbation. Experimental results show that PonziHunter outperforms state-of-the-art tools with average improvements of at least 4.77% on real-world ground-truth data and can newly discover 85 Ponzi contracts in the wild. More importantly, PonziHunter is robust against adversarial examples and can locate the critical basic blocks for smart Ponzi detection.

In recent years, phishing scams have caused huge economic losses in Ethereum, the largest blockchain platform enabling smart contracts. Many new sorts of phishing attacks based on smart contracts, specifically targeting Ethereum assets such as Ether and tokens, are emerging. Existing Ethereum phishing detection methods usually mine the transaction relationships among accounts from block data, while neglecting to mine the temporal transaction patterns inherent in the accounts themselves in different transaction types introduced by smart contracts. Such information provides a new perspective for analyzing account transaction preferences. However, since this information is hidden in heterogeneous data such as trace data and event logs, it is difficult to analyze and mine the information. In this paper, we contribute Trans2Graph, a novel graph-based framework for Ethereum data modeling and phishing detection, to fully exploit the massively heterogeneous temporal transaction data. We propose a new paradigm for the fusion of heterogeneous Ethereum data and model the implicit transition relationships among multiple heterogeneous transactions of each Ethereum account into a heterogeneous, temporal, directed multigraph called transaction state transition graph. Empirical analysis shows that phishing accounts have unique patterns in both the heterogeneity and time dynamics of transaction state transition graphs. Based on the analysis, we develop a novel attention-based graph neural network for the learning of heterogeneous temporal state transition graphs and phishing detection. Experiments on a large-scale real-world dataset demonstrate that Trans2Graph achieves a minimum 52.57% improvement in the average precision metric on state-of-the-art account interaction graph-based methods and a minimum 11.52% improvement in average precision on transaction sequence-based methods.

The non-fungible token (NFT) is an emergent type of cryptocurrency that has garnered extensive attention since its inception. The uniqueness, indivisibility, and humanistic value of NFTs are the key characteristics that distinguish them from traditional tokens. The market capitalization of NFT reached 21.5 billion USD in 2021, almost 200 times that of all previous transactions. However, the subsequent rapid decline in NFT market fever in the second quarter of 2022 casts doubt on the ostensible boom in the NFT market. To date, there has been no comprehensive and systematic study of the NFT trade market or of the NFT bubble and hype phenomenon. To address this gap, we conduct an in-depth investigation of the entire Ethereum ERC721 and ERC1155 NFT ecosystems by dividing the NFT ecosystem participants into three categories: creators, transferors, and holders, to understand their manipulations of NFTs and infer their intentions. We examine the differences between NFT and ERC20 traders and then analyze the possible reasons behind these differences, leading us to gain insights into the varying degrees of market bubble associated with the two kinds of tokens. Through the construction and analysis of the NFT transfer graph (NTG), we uncover certain anomalous behaviors related to bubbles, along with quantifying the proportion of these anomalous behaviors, to reveal the degree of bubbles within the entire ecosystem.

As one of the most typical cybercrime types, phishing scams have extended the devil’s hand to the emerging blockchain ecosystem in recent years. Especially, huge economic losses have been caused by phishing scams in Ethereum, the second-largest blockchain system. Existing approaches for Ethereum phishing detection, however, typically use machine learning or transaction graph embedding methods to identify phishers in isolation and do not effectively uncover the group of transaction accounts linked to scams (which we term a “gang”). Since accounts are pseudonymous in Ethereum, these undisclosed conspirator accounts have potential risks to the system. In this paper, we conduct the first study that characterizes and detects Ethereum phishing gangs. We first investigate the transaction behaviors in phishing gangs from the perspectives of individuals, pairs, and higher-order patterns. Our analysis reveals that although the Ethereum transaction graph is sparse with a highly skewed degree distribution, phishing accounts in the same gang have closer relationships and share specific transaction patterns. Based on our findings, we formalize the phishing gang detection problem and introduce a novel detection model named PGDetector. Given a risky phishing account as a seed, PGDetector can find out the potential risky accounts sharing close relationships within the seed’s community based on genetic algorithm optimization. Experimental results on large-scale Ethereum transaction data demonstrate the effectiveness of PGDetector.

With the popularity of Non-Fungible Tokens (NFTs), the high value of NFTs makes them a target for phishing scammers, which harms the security and reliability of the Web3 NFT ecosystem. Despite the significance of this issue, there is a lack of systematic research in the area of emerging NFT phishing scams. To address this gap, we are the first to conduct a case retrospective analysis and empirical measurement study of real-world historical NFT phishing scams on Ethereum. We collect and publicly release the first NFT phishing dataset which includes 1,625 NFT phishing accounts and transaction records as of August 2023. We further categorize the existing scams into four phishing patterns and investigate their distinguishable behaviors. Then, we reveal the modus operandi preferences and economic impacts to characterize NFT phishing scams. We find that NFT phishers stole 67,188 NFTs, with a total direct selling profit of${\$}$20.92 million. We also observe that scammers favor certain categories and collections of NFTs, coupled with signs of gang theft. Furthermore, we design a variety of account features for the classification task of NFT phishers based on empirical conclusions. Experimental results on real-world NFT transaction data demonstrate the effectiveness of these features in detecting NFT phishing accounts, and outperform traditional phishing detection methods with 41% average Precision and 44% average Recall.

Overdue risk detection of consumer loans is a critical issue faced by consumer finance companies. Unlike other types of loans, such as mortgage loans and guaranteed loans, consumer loans only regard personal credit as collateral. As a high overdue rate will result in economic losses to financial companies, it is of great significance for lenders to accurately detect risky customers. However, the large volume of credit data and the variety of customer characteristics make the risk detection via manual expert analysis rather challenging. Additionally, previous loan risk detection approaches based on machine learning classification neglect the relations between different customers, and traditional graph neural networks lack the exploration of loan overdue patterns. In this paper, we construct a heterogeneous graph based on real credit data from a consumer finance company. We analyze the distribution of meta-paths and propose a meta-path-based graph neural network that combines both lower-order and higher-order features. Experimental results show that our model is able to detect more risky customers by exploring overdue patterns and can achieve the best effect in the loan overdue detection task.

As one of the most active blockchain platforms at present, Ethereum attracts a great deal of interest, including that of fraudsters. They exploit the anonymity of Ethereum accounts to perpetrate varieties of scams, the most common of which is phishing frauds. However, existing phishing detection work ignores the heterogeneity of Ethereum transaction edges. In fact, the activities on Ethereum include external transactions, internal transactions, and token transactions. Therefore, this paper proposes an Ethereum account phishing fraud detection method named HTSGCN. Based on heterogeneous transaction subnets, our method makes full use of the type and direction information contained in transactions. First, we collect Ethereum transaction data and construct a k-order heterogeneous subnet for each account. To aggregate the neighbor feature, we design a message propagation mechanism based on graph convolution network. Finally, we classify node representation vectors containing neighborhood and its own characteristics. Experimental results show that HTSGCN has a better effect on detecting phishing accounts than previous work which is based on homogeneous networks.

Phishing is a widespread scam activity on Ethereum, causing huge financial losses to victims. Most existing phishing scam detection methods abstract accounts on Ethereum as nodes and transactions as edges, then use manual statistics of static node features to obtain node embedding and finally identify phishing scams through classification models. However, these methods can not dynamically learn new Ethereum transactions. Since the phishing scams finished in a short time, a method that can detect phishing scams in real-time is needed. In this paper, we propose a streaming phishing scam detection method. To achieve streaming detection and capture the dynamic changes of Ethereum transactions, we first abstract transactions into edge features instead of node features, and then design a broadcast mechanism and a storage module, which integrate historical transaction information and neighbor transaction information to strengthen the node embedding. Finally, the node embedding can be learned from the storage module and the previous node embedding. Experimental results show that our method achieves decent performance on the Ethereum phishing scam detection task.

Web3, based on blockchain technology, is the evolving next generation Internet of value. Massive active applications on Web3, e.g. DeFi and NFT, usually rely on blockchain transactions to achieve value transfer as well as complex and diverse custom logic and intentions. Various risky or illegal behaviors such as financial fraud, hacking, money laundering are currently rampant in the blockchain ecosystem, and it is thus important to understand the intent behind the pseudonymous transactions. To reveal the intent of transactions, much effort has been devoted to extracting some particular transaction semantics through specific expert experiences. However, the limitations of existing methods in terms of effectiveness and generalization make it difficult to extract diverse transaction semantics in the rapidly growing and evolving Web3 ecosystem. In this paper, we propose the Motif-based Transaction Semantics representation method (MoTS), which can capture the transaction semantic information in the real-time transaction data workflow. To the best of our knowledge, MoTS is the first general semantic extraction method in Web3 blockchain ecosystem. Experimental results show that MoTS can effectively distinguish different transaction semantics in real-time, and can be used for various downstream tasks, giving new insights to understand the Web3 blockchain ecosystem. Our codes are available at https://github.com/wuzhy1ng/MoTS.

As one of the most popular blockchain systems, EOSIO has been widely used in decentralized applications (DApps). Compared with traditional proof-of-work (PoW)-based blockchain systems like Bitcoin, EOSIO achieves a high transaction throughput and an alleged decentralization with the Delegated Proof-of-Stake (DPoS) consensus protocol. However, recent reports claimed the existence of voting collusion and manipulation during the DPoS consensus procedure of EOSIO, which may greatly decline the decentralization degree, fault tolerance, and reliability of the whole system. In this article, we obtain data from up to 135 000 000 blocks of EOSIO and conduct a data-driven decentralization analysis. Specifically, we characterize the decentralization evolution of the two phases in DPoS, namely block producer election and block production. Moreover, we study the voters with similar voting behaviors and propose methods to discover abnormal mutual voting behaviors in EOSIO. The analysis results show how EOSIO gradually evolves from decentralization to oligopoly and our methods can effectively capture abnormal voting phenomena in the EOSIO, which can also provide important insights for the design and maintenance of other DPoS-based blockchains.

Security incidents such as scams and hacks have become a major threat to the health of the blockchain ecosystem, resulting in billions of dollars in losses to blockchain users each year. To reveal the real-world entities behind pseudonymous blockchain accounts and recover stolen funds from massive transaction data, much effort has recently been put into tracing illicit financial flows in blockchain by academia and industry. However, most of the current blockchain fund tracing methods are heuristics and taint analysis methods that are designed on the basis of expert experience and specific events, which have limitations in terms of universality, effectiveness and efficiency. This paper models blockchain transaction records as a transaction graph and tackles blockchain transaction tracing as a graph search task. To achieve efficient and effective tracing of fund transfers on the transaction graphs, we propose a scalable transaction tracing tool, TRacer, which to the best of our knowledge is thefirstintelligent transaction tracing tool that is generalized to multiple account-based blockchain platforms and can handle complex transaction behavior in decentralized finance (DeFi). Particularly, we tackle the transaction tracing task via a subgraph searching approach which employ a novel ranking method to infer the relevance between accounts during the graph search process in the multi-relational blockchain transaction graph. Theoretical analysis and experimental results on datasets from multiple blockchain platforms demonstrate that TRacer can efficiently perform the transaction tracing task at a lower cost and achieve better tracing results than existing methods or even expert manual audits.

Due to the widespread use of smart contracts, Ethereum has become the second-largest blockchain platform after Bitcoin. Many different types of Ethereum accounts (ICO, Mining, Gambling, etc.) also have quite active trading activities on Ethereum. Studying the transaction records of these specific Ethereum accounts is very important for understanding their particular transaction characteristics, and further labeling the pseudonymous accounts. However, traditional methods are generally based on static and global transaction networks to conduct research, ignoring useful information about dynamic changes. Our work chooses six kinds of important account labels, and builds ego networks for each kind of Ethereum account. We focus on the interaction between the target node and neighbor nodes with temporal analysis. Experiments show that there is a significant difference between various types of accounts in terms of several network features, helping us better understand their transaction patterns. To the best of our knowledge, this is the first work to analyze the dynamic characteristics of Ethereum labeled accounts from the perspective of transaction ego networks.

With a large market capitalization, Ethereum is one of the most famous blockchain platforms supporting smart contracts nowadays. To better understand Ethereum, previous researches have performed numerous analyses on Ethereum via complex network theory, while many of them merely focus on a single perspective of scale or time series. This motivates us to investigate the evolution of Ethereum from a local point of view. We concentrate our study on some key accounts labeled by the community. Then we crawl and extract their transaction subgraphs, and conduct an analysis based on several basic network properties consisting of network scale and triadic tendencies by sliding window. Furthermore, we provide an insight into the local structure of these subgraphs by counting the graphlets induced from the label nodes. Subsequently, we observe diverse similarities and differences between various label nodes in the changing trend and subgraph patterns in the locality of Ethereum networks. The results and findings from this study may help us to understand the activity of Ethereum more comprehensively.

As the first decentralized peer-to-peer (P2P) cryptocurrency system allowing people to trade with pseudonymous addresses, Bitcoin has become increasingly popular in recent years. However, the P2P and pseudonymous nature of Bitcoin make transactions on this platform very difficult to track, thus triggering the emergence of various illegal activities in the Bitcoin ecosystem. Particularly,mixing servicesin Bitcoin, originally designed to enhance transaction anonymity, have been widely employed for money laundering to complicate the process of trailing illicit fund. In this article, we focus on the detection of the addresses belonging to mixing services, which is an important task for anti-money laundering in Bitcoin. Specifically, we provide a feature-based network analysis framework to identify statistical properties of mixing services from three levels, namely, network level, account level, and transaction level. To better characterize the transaction patterns of different types of addresses, we propose the concept of attributed temporal heterogeneous motifs (ATH motifs). Moreover, to deal with the issue of imperfect labeling, we tackle the mixing detection task as a positive and unlabeled learning (PU learning) problem and build a detection model by leveraging the considered features. Experiments on real Bitcoin datasets demonstrate the effectiveness of our detection model and the importance of hybrid motifs including ATH motifs in mixing detection.

As one of the most important and famous applications of blockchain technology, cryptocurrency has attracted extensive attention recently. Empowered by blockchain technology, all the transaction records of cryptocurrencies are irreversible and recorded in the blocks. These transaction records containing rich information and complete traces of financial activities are publicly accessible, thus providing researchers with unprecedented opportunities for data mining and knowledge discovery in this area. Networks are a general language for describing interacting systems in the real world, and a considerable part of existing work on cryptocurrency transactions is studied from a network perspective. This survey aims to analyze and summarize the existing literature on analyzing and understanding cryptocurrency transactions from a network perspective. Aiming to provide a systematic guideline for researchers and engineers, we present the background information of cryptocurrency transaction network analysis and review existing research in terms of three aspects, i.e., network modeling, network profiling, and network-based detection. For each aspect, we introduce the research issues, summarize the methods, and discuss the results and findings given in the literature. Furthermore, we present the main challenges and several future directions in this area.