As a key infrastructure for social fintech ecosystems, ethereum enables decentralized finance (DeFi) applications where security issues directly compromise ecosystem stability. Among critical security concerns, ethereum phishing scams stand as typical scams. Criminals employ distinctive fund transfer patterns (e.g., money laundering stages: placement, layering, and integration) to obscure illicit funds through long transaction paths. While graph neural networks (GNNs) dominate detection methods, they fail to model these long paths effectively. To address this, we propose the first framework to detect phishing scams through explicitly modeling fund transfer patterns. Our novel method, IMPUTATION, introduces: 1) a heuristic fund transfer path graph construction method utilizing iterative transaction pairing to capture complicated fund transfer patterns; 2) role-topology account embeddings encoding fund transfer patterns; 3) attention fusion leveraging initial transactions to suppress path noise; and 4) heterogeneous correlation graphs with weighted adjacency reconstruction modeling interpath dependencies. Extensive experiments demonstrate that IMPUTATION outperforms on all five metrics and detecting Ethereum phishing scams from fund transfer patterns is effective.

Due to the strong untraceability of mixing services, numerous criminals exploit these services to engage in illicit activities, posing a significant threat to the blockchain ecosystem. This paper addresses the challenge of linking transaction addresses in Tornado Cash, a popular mixing service on Ethereum. While existing state-of-the-art solutions like MixBroker attempt to address this problem, two fundamental limitations persist: insufficient utilization of neighbor information and neglect of address information asymmetry. To address these gaps, a novel framework termed “MixLinker” is proposed, which enhances neighbor information utilization and models information asymmetry. Specifically, a Normalized Adjusted Personal PageRank (NAPPR) module is designed to prioritize significant neighbor nodes while mitigating interference from super and irrelevant addresses. Additionally, tensors are employed to model transactions, capturing rich interaction features related to transaction attributes. Based on historical transaction sequences, Tensor Long Short-Term Memory (TLSTM) is used to obtain high-quality initial input features for the Graph Neural Network (GNN) module, enabling effective learning of nonlinear dynamics. To ensure symmetric output results and model asymmetric information, a temporal-aware symmetry classifier is constructed that leverages asymmetric information through permutation operations and an order-aware classifier. Extensive experiments demonstrate that MixLinker outperforms other methods, validating the effectiveness of the proposed approach and confirming the two underlying motivations.