Phishing Detection in Ethereum via Temporal Graph Contrastive Learning

• URL: http://arxiv.org/abs/2605.01207v1
• Date: Sat, 02 May 2026 02:53:53 GMT
• Title: Phishing Detection in Ethereum via Temporal Graph Contrastive Learning
• Abstract summary: Existing phishing detection methods primarily rely on graph learning.<n>In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities.<n>The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods.
• Score: 8.217132307053747
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Blockchain and decentralized finance have revolutionized the financial ecosystem while simultaneously exposing it to cryptocurrency phishing attacks. Existing phishing detection methods primarily rely on graph learning, but they face significant limitations. Static graph learning approaches fail to account for the temporal evolution of phishing patterns, while semi-dynamic methods, such as those combining static GNNs with LSTM, struggle to capture the irregular and bursty nature of blockchain transactions. Moreover, these methods overlook the diversity of Ethereum transactions, treating them as homogeneous graphs, and heavily rely on supervised learning, which requires extensive labeled data that is not readily available. These limitations reduce their adaptability to emerging phishing threats. In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities. PhishEye formulates Ethereum transactions as a heterogeneous temporal attributed multi-graph and incorporates a novel temporal graph contrastive learning model, which captures both temporal patterns and heterogeneous transaction types. The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods, achieving an F1 score of 87.23% and an AUC of 98.43% for phishing transaction detection, and an F1 score of 94.19% and an AUC of 98.03% for phishing account detection. In real-world deployment from May 1, 2023 to July 31, 2024, PhishEye identified 1,803 previously unknown phishing addresses, providing early alerts that helped prevent losses exceeding 2 billion USD.

Related papers

• Blockchain Transaction Simulation Phishing [41.25322759036545]
  We present the first comprehensive study of transaction simulation phishing.<n>We detect over 4,000 phishing contracts deployed between August 2024 and June 2025.<n>Our analysis identifies more than 5,700 victims and approximately $3.48 million USD in losses, 91.5% of which occurred on clustering.
  arXiv  Detail & Related papers  (2026-07-30T18:09:56Z)
• Temporal Motif-aware Graph Test-time Adaptation for OOD Blockchain Anomaly Detection [55.18577006122169]
  We propose a novel framework termed textbfTEmporal textbfMotif-aware textbfGraph textbfTest-textbfTime textbfAdaptation (textbfTEMG-TTA)<n>First, we comprehensively capture the 3-node temporal motif distribution of each active address using an efficient computational mechanism.<n>Second, we design a simple yet effective test-time adaptation strategy to facilitate the sharing of common patterns between training and testing graphs.
  arXiv  Detail & Related papers  (2026-05-28T07:43:20Z)
• Enhancing Phishing Detection in Financial Systems through NLP [2.9687381456164004]
  The threat of phishing attacks in financial systems is continuously growing.<n>Several existing methods, including blacklists and whitelists, play a crucial role in detecting phishing attempts.<n>This paper presents a pioneering Natural Language Processing (NLP) approach for phishing email detection.
  arXiv  Detail & Related papers  (2025-07-06T15:20:25Z)
• EXPLICATE: Enhancing Phishing Detection through Explainable AI and LLM-Powered Interpretability [44.2907457629342]
  EXPLICATE is a framework that enhances phishing detection through a three-component architecture.<n>It is on par with existing deep learning techniques but has better explainability.<n>It addresses the critical divide between automated AI and user trust in phishing detection systems.
  arXiv  Detail & Related papers  (2025-03-22T23:37:35Z)
• Deep Learning Approaches for Anti-Money Laundering on Mobile Transactions: Review, Framework, and Directions [51.43521977132062]
  Money laundering is a financial crime that obscures the origin of illicit funds.<n>The proliferation of mobile payment platforms and smart IoT devices has significantly complicated anti-money laundering investigations.<n>This paper conducts a comprehensive review of deep learning solutions and the challenges associated with their use in AML.
  arXiv  Detail & Related papers  (2025-03-13T05:19:44Z)
• Across-Platform Detection of Malicious Cryptocurrency Transactions via Account Interaction Learning [19.2372535101502]
  Existing malicious transaction detection methods rely on large amounts of labeled data. We propose ShadowEyes, a novel malicious transaction detection method. We conduct extensive experiments using public datasets to evaluate the performance of ShadowEyes.
  arXiv  Detail & Related papers  (2024-10-31T02:01:42Z)
• Dissecting Payload-based Transaction Phishing on Ethereum [13.398858969125495]
  payload-based transaction phishing (PTXPHISH) manipulates smart contract interactions through the execution of malicious payloads to deceive users. PTXPHISH has rapidly emerged as a significant threat, leading to incidents that caused losses exceeding $70 million in 2023 reports. We establish the first ground-truth PTXPHISH dataset, consisting of 5,000 phishing transactions. We propose a rule-based multi-dimensional detection approach to identify PTXPHISH, achieving over 99% accuracy in the ground-truth dataset.
  arXiv  Detail & Related papers  (2024-09-04T02:26:59Z)
• Transaction Fraud Detection via an Adaptive Graph Neural Network [64.9428588496749]
  We propose an Adaptive Sampling and Aggregation-based Graph Neural Network (ASA-GNN) that learns discriminative representations to improve the performance of transaction fraud detection. A neighbor sampling strategy is performed to filter noisy nodes and supplement information for fraudulent nodes. Experiments on three real financial datasets demonstrate that the proposed method ASA-GNN outperforms state-of-the-art ones.
  arXiv  Detail & Related papers  (2023-07-11T07:48:39Z)
• G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering [116.4277292854053]
  Federated Learning (FL) offers collaborative model training without data sharing. FL is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. We present G$2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem.
  arXiv  Detail & Related papers  (2023-06-08T07:15:04Z)
• Blockchain Large Language Models [65.7726590159576]
  This paper presents a dynamic, real-time approach to detecting anomalous blockchain transactions. The proposed tool, BlockGPT, generates tracing representations of blockchain activity and trains from scratch a large language model to act as a real-time Intrusion Detection System.
  arXiv  Detail & Related papers  (2023-04-25T11:56:18Z)
• Blockchain Phishing Scam Detection via Multi-channel Graph Classification [1.6980621769406918]
  Phishing scam detection methods will protect possible victims and build a healthier blockchain ecosystem. We defined the transaction pattern graphs for users and transformed the phishing scam detection into a graph classification task. The proposed multi-channel graph classification model (MCGC) is more able to detect potential phishing by extracting the transaction pattern features of the target users.
  arXiv  Detail & Related papers  (2021-08-19T02:59:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.