Unmasking Malicious Actors: Tracing Scammers on the Ethereum Blockchain

Abstract

The emergence of Blockchain 2.0, along with the introduction of smart contracts (SCs), has facilitated the development of automated decentralized financial interactions on various platforms. These programmable contracts are utilized in applications including decentralized finance (DeFi), token issuance, and automated fund transfers. However, the pseudonymous nature of blockchain transactions, combined with automation capabilities and mixing services, has been exploited by malicious actors to launder illicit proceeds. Most of the techniques in the state-of-theart approaches detect addresses related to such illicit actors by relying on machine learning techniques that use only transactionbased features. In this work, we propose an algorithm to detect and identify addresses that are related to scamming activities, such as phishing. We focus on Ethereum, one of the widely adopted blockchains, and analyze over 1.8 billion transactions to identify SC deployments, thereby creating an SC deployment mapping. Alongside this mapping, we construct a transaction graph of known scam-related accounts, which we use to identify accounts involved in laundering proceeds from these scams. This approach identifies 32,272 accounts associated with known scam addresses. The proposed algorithm takes an average of 0.024 seconds to determine whether an address is illicit. We also identify three recurring motifs characteristic of scam-related addresses, which can aid blockchain forensic frameworks in detecting such activities. By validating our findings with crypto-forensic tools, we uncover additional malicious addresses and provide actionable insights for law enforcement agencies.

Publication
BCCA 2025

Related