Real-CATS: A Practical Training Ground for Emerging Research on Cryptocurrency Cybercrime Detection

TL;DR

Real-CATS addresses the critical lack of real-world labeled cryptocurrency addresses for cybercrime detection by introducing a large, real-world dataset with both criminal and benign addresses across Bitcoin and Ethereum, complemented by a supplementary Sup-CATS test set to simulate deployment. The dataset provides rich transaction profiles (32 Bitcoin features and 52 Ethereum features, including 16 token-interaction features) sourced from abuse reports and exchange hot-wallets, enabling comprehensive evaluation and feature customization. The work demonstrates that Real-CATS satisfies the C3R criteria and supports cross-disciplinary research, with empirical analyses showing realistic distributions, separability, and practical transferability to real-world scenarios. By releasing open datasets and illustrating graph-based extension potential, Real-CATS aims to accelerate advances in cryptocurrency cybercrime detection and related anti-money-laundering research, with potential expansion to other blockchains.

Abstract

Cybercriminals pose a significant threat to blockchain trading security, causing $40.9 billion in losses in 2024. However, the lack of an effective real-world address dataset hinders the advancement of cybercrime detection research. The anti-cybercrime efforts of researchers from broader fields, such as statistics and artificial intelligence, are blocked by data scarcity. In this paper, we present Real-CATS, a Real-world dataset of Cryptocurrency Addresses with Transaction profileS, serving as a practical training ground for developing and assessing detection methods. Real-CATS comprises 103,203 criminal addresses from real-world reports and 106,196 benign addresses from exchange customers. It satifies the C3R characteristics (Comprehensiveness, Classifiability, Customizability, and Real-world Transferability), which are fundemental for practical detection of cryptocurrency cybercrime. The dataset provides three main functions: 1) effective evaluation of detection methods, 2) support for feature extensions, and 3) a new evaluation scenario for real-world deployment. Real-CATS also offers opportunities to expand cybercrime measurement studies. It is particularly beneficial for researchers without cryptocurrency-related knowledge to engage in this emerging research field. We hope that studies on cryptocurrency cybercrime detection will be promoted by an increasing number of cross-disciplinary researchers drawn to this versatile data platform. All datasets are available at https://github.com/sjdseu/Real-CATS

Figures (5)

• Figure 1: Workflow of address collection and profile extraction process. CB and BB are criminal and benign addresses on Bitcoin. CE and BE are criminal and benign addresses on Ethereum. TI_C and TI_B are token interactions of criminal and benign Ethereum addresses.
• Figure 2: Scatterplot of received and sent Sat and the CDF of $Lifetime$ for criminal and benign addresses on Bitcoin. Red line indicates received number equals sent number. Red text is the percentage of zero balance addresses. The received vs. sent distribution indicates that criminal addresses are more likely to transfer all funds, and benign addresses tend to last longer than criminal addresses.
• Figure 3: Scatterplot of received and sent Sat and the CDF of $Lifetime$ for criminal addresses in existing datasets. Red line indicates the balance is zero where the received number equals the sent number. Red text is the percentage of zero balance addresses. Criminal addresses present overly apparent features in existing datasets.
• Figure 4: Scatterplot of received and sent Wei and the CDF of $Lifetime$ for criminal and benign addresses on Ethereum. Red line indicates received number equals sent number. Red text is the percentage of zero balance addresses. The received vs. sent on Ethereum is evidently different. And the benign addresses tend to last longer than criminal addresses.
• Figure 5: t-SNE visualization of address profiles on both blockchains, showing the effectiveness of our profiles. Red points indicate criminal addresses. Blue points are benign addresses.