Abstract:The prosperity of Ethereum attracts many users to send transactions and trade crypto assets. However, this has also given rise to a new form of transaction-based phishing scam, named TXPHISH. Specifically, tempted by high profits, users are tricked into visiting fake websites and signing transactions that enable scammers to steal their crypto assets. The past year has witnessed 11 large-scale TXPHISH incidents causing a total loss of more than $70 million. In this paper, we conduct the first empirical study of TXPHISH on Ethereum, encompassing the process of a TXPHISH campaign and details of phishing transactions. To detect TXPHISH websites and extract phishing accounts automatically, we present TxPhishScope, which dynamically visits the suspicious websites, triggers transactions, and simulates results. Between November 25, 2022, and July 31, 2023, we successfully detected and reported 26,333 TXPHISH websites and 3,486 phishing accounts. Among all of documented TXPHISH websites, 78.9% of them were first reported by us, making TxPhishScope the largest TXPHISH website detection system. Moreover, we provided criminal evidence of four phishing accounts and their fund flow totaling $1.5 million to aid in the recovery of funds for the victims. In addition, we identified bugs in six Ethereum projects and received appreciation. Based on the detection results, we perform a comprehensive study of TXPHISH websites and phishing accounts. Our study reveals that TXPHISH websites have a short lifespan, low cost, and fast update frequency. Besides, Our analysis of phishing fund flow demonstrates that 54.0% of phishing funds ($43.7 million) flowed into centralized exchanges, where the identity of owners could be traced. Our research can serve as a valuable reference for Ethereum service providers to safeguard their users against TXPHISH and assist in the recovery of victims' crypto assets.

Victimized by Phishing: A Heuristic-Systematic Perspective

SoK: Human-Centered Phishing Susceptibility

TxPhishScope: Towards Detecting and Understanding Transaction-based Phishing on Ethereum

Theoretical basis and occurrence of internet fraud victimisation: Based on two systems in decision-making and reasoning

Using a Computational Cognitive Model to Understand Phishing Classification Decisions of Email Users

The applicability of a hybrid framework for automated phishing detection

Analyzing the risk and financial impact of phishing attacks using a knowledge based approach

Predicting User Susceptibility to Phishing Based on Multidimensional Features

SOK: A Comprehensive Reexamination of Phishing Research from the Security Perspective

Human Factors in Phishing Attacks: A Systematic Literature Review

Analysis of Phishing Attacks and Countermeasures

Investigation of Phishing Susceptibility with Explainable Artificial Intelligence

An Overview of Phishing Victimization: Human Factors, Training and the Role of Emotions

"Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages

An efficient multistage phishing website detection model based on the CASE feature framework: Aiming at the real web environment

Phishpedia: A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages

Eyes on the Phish(er): Towards Understanding Users' Email Processing Pattern and Mental Models in Phishing Detection

The Anatomy of Deception: Measuring Technical and Human Factors of a Large-scale Phishing Campaign

Many Phish in the $\mathcal{C}$: A Coexisting-Choice-Criteria Model of Security Behavior

The Anatomy of Deception: Technical and Human Perspectives on a Large-scale Phishing Campaign

Predicting susceptibility to social influence in phishing emails