Extracting and Verifying Illicit Bitcoin Addresses from Underground Forum Discussions

• URL: http://arxiv.org/abs/2608.13930v1
• Date: Fri, 14 Aug 2026 04:04:13 GMT
• Title: Extracting and Verifying Illicit Bitcoin Addresses from Underground Forum Discussions
• Abstract summary: We present a pipeline for constructing evidence-backed Bitcoin labels from HackForums, an underground cybercrime forum with fifteen years of archived activity.<n>The pipeline combines LLM-assisted screening, expert review, and on-chain validation to identify Bitcoin addresses explicitly associated with illicit transactions discussed on the forum.<n>The resulting dataset contains 2,438 manually verified illicit Bitcoin addresses spanning 2010-2024 and twelve cybercrime categories assigned during LLM screening.
• Score: 0.021748200848556342
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Existing labeled Bitcoin datasets are largely derived from community-reported abuse, blockchain heuristics, incident-specific collections, or proprietary labeling processes. Their construction methods are rarely publicly reproducible and often provide limited evidence that an address was directly involved in illicit activity. We present a reproducible pipeline for constructing evidence-backed Bitcoin labels from HackForums, an underground cybercrime forum with fifteen years of archived activity. The pipeline combines LLM-assisted screening, expert review, and on-chain validation to identify Bitcoin addresses explicitly associated with illicit transactions discussed on the forum. Each released label is supported by contextual evidence from underground discussions and validated on-chain. The resulting dataset contains 2,438 manually verified illicit Bitcoin addresses spanning 2010-2024 and twelve cybercrime categories assigned during LLM screening. We release the dataset, temporal metadata, and the complete extraction pipeline to support reproducible research on cryptocurrency-facilitated cybercrime.

Related papers

• FlowShield: cryptocurrency anti-money laundering with transaction semantics parsing and fund flow tracking [46.45233269509415]
  textscFlowShield is a Crypto AML framework for transaction-level laundering detection and investigator-facing report generation.<n>textscFlowShield reconstructs fund-flow subgraphs from three complementary perspectives.<n>It then employs a text--structure fusion mechanism, enabling the interplay between large language model (LLM)-encoded semantics and flow texts with graph convolutional network (GCN)-encoded structure.
  arXiv  Detail & Related papers  (2026-08-18T04:21:19Z)
• TxRay: Agentic Postmortem of Live Blockchain Attacks [52.658018348998105]
  Within five years, the DeFi ecosystem has lost over 15.75B USD to reported exploits.<n>We present TxRay, a postmortem system that reconstructs live ACT attacks from limited evidence.<n>On 114 incidents from DeFiHackLabs, TxRay produces an expert-aligned root cause and an executable PoC for 105 incidents, achieving 92.11% end-to-end reproduction.
  arXiv  Detail & Related papers  (2026-02-01T16:17:33Z)
• MemeChain: A Multimodal Cross-Chain Dataset for Meme Coin Forensics and Risk Analysis [52.468043639056596]
  The meme coin ecosystem has grown into one of the most active yet least observable segments of the cryptocurrency market.<n>MemeChain integrates on-chain data with off-chain artifacts, including website HTML source code, token logos, and linked social media accounts.<n>We quantify the ecosystem's extreme volatility, identifying 1,801 tokens (5.15%) that cease all trading activity within just 24 hours of launch.
  arXiv  Detail & Related papers  (2026-01-28T14:42:02Z)
• The Treasury Proof Ledger: A Cryptographic Framework for Accountable Bitcoin Treasuries [0.0]
  This paper introduces the Treasury Proof Ledger (TPL), a Bitcoin-anchored logging framework for multi-domain Bitcoin treasuries.<n>A TPL instance records proof-of-reserves snapshots, proof-of-transit receipts for movements between domains, and policy metadata.<n>We show how TPL could support responsible transparency policies and future cross-institution checks consistent with Bitcoin's fixed monetary supply.
  arXiv  Detail & Related papers  (2025-12-03T13:14:06Z)
• The Devil Behind the Mirror: Tracking the Campaigns of Cryptocurrency Abuses on the Dark Web [39.96427593096699]
  We identify 2,564 illicit sites with 1,189 illicit blockchain addresses, which account for 90.8 BTC in revenue. Our exploration suggests that illicit activities on the dark web have strong correlations, which can guide us to identify new illicit blockchain addresses and onions.
  arXiv  Detail & Related papers  (2024-01-09T16:35:25Z)
• Interplay between Cryptocurrency Transactions and Online Financial Forums [41.94295877935867]
  This study focuses on the study of the interplay between these cryptocurrency forums and fluctuations in cryptocurrency values. It shows that the activity of Bitcointalk forum keeps a direct relationship with the trend in the values of BTC. The experiment highlights that forum data can explain specific events in the financial field.
  arXiv  Detail & Related papers  (2023-11-27T16:25:28Z)
• Inspection-L: Practical GNN-Based Money Laundering Detection System for Bitcoin [0.0]
  This paper proposes Inspection-L, a graph neural network (GNN) framework based on self-supervised Deep Graph Infomax (DGI), with Random Forest (RF) to detect illicit transactions for Anti-Money laundering (AML) To the best of our knowledge, our proposal is the first of applying self-supervised GNNs to the problem of AML in Bitcoin. The proposed method has been evaluated on the Elliptic dataset and shows that our approach outperforms the state-of-the-art in terms of key classification metrics.
  arXiv  Detail & Related papers  (2022-03-20T06:19:18Z)
• Quantum Multi-Solution Bernoulli Search with Applications to Bitcoin's Post-Quantum Security [67.06003361150228]
  A proof of work (PoW) is an important cryptographic construct enabling a party to convince others that they invested some effort in solving a computational task. In this work, we examine the hardness of finding such chain of PoWs against quantum strategies. We prove that the chain of PoWs problem reduces to a problem we call multi-solution Bernoulli search, for which we establish its quantum query complexity.
  arXiv  Detail & Related papers  (2020-12-30T18:03:56Z)
• Machine learning methods to detect money laundering in the Bitcoin blockchain in the presence of label scarcity [1.7499351967216341]
  We show that existing state-of-the-art solutions using unsupervised anomaly detection methods are inadequate to detect the illicit patterns in a real Bitcoin transaction dataset. Our proposed active learning solution is capable of matching the performance of a fully supervised baseline by using just 5% of the labels.
  arXiv  Detail & Related papers  (2020-05-29T15:52:48Z)
• Cryptocurrency Address Clustering and Labeling [2.475112368179548]
  Anonymity is one of the most important qualities of blockchain technology. In general, the real identity behind cryptocurrency addresses is not known. Some addresses can be clustered according to their ownership by analyzing behavioral patterns.
  arXiv  Detail & Related papers  (2020-03-30T12:34:11Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.