Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach

Frank Fan; Haishan Wu; Qiangqiang Liu; Qian Huang; Xueyan Tang

REVIEW 4 major objections 7 minor 22 references

Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach

T0 review · 4 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Subgraph-based LightGBM detects Sybil airdrop addresses with all metrics above 0.9.

desk verdict Plausible first supervised airdrop-sybil method, but the evaluation's undisclosed label generation and missing train/test split keep the >0.9 claims unproven; deserves a careful major-revision round. read the letter →

arxiv 2505.09313 v1 pith:2J3ONOLM submitted 2025-05-14 cs.CR cs.LG

Qiangqiang Liu , Qian Huang , Frank Fan , Haishan Wu , Xueyan Tang This is my paper · ORCID

classification cs.CRcs.LG

keywords sybilattackairdropfraudsubgraphfeatureextractionLightGBMpropagationtransactiongraphanalysisblockchainsecuritysupervisedclassification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a supervised model built on transaction-subgraph features can identify Sybil addresses in airdrops more reliably than the unsupervised clustering methods currently used for that task. The model first builds a two-layer transaction subgraph around each address, then extracts time features tied to the Sybil lifecycle (first gas receipt, first transaction, first airdrop participation, last transaction) together with amount and network-structure features, and propagates and fuses those features through the subgraph. On a dataset of 193,701 addresses, including 23,240 confirmed Sybil addresses, the resulting LightGBM classifier reports precision 0.9428, recall 0.9182, F1 0.9303, and AUC 0.9806, outperforming standard classifiers and a clustering-based Sybil detector. If correct, this makes supervised detection practical for long-running airdrops and reduces reliance on manually tuned clustering thresholds.

What carries the argument

The load-bearing object is the two-layer transaction subgraph representation with cascade feature propagation and fusion. For a target address at level 0, the subgraph includes two layers of senders above it and two layers of recipients below it; features computed at each level are aggregated toward the target—amounts by min/max/mean/variance, degrees by summation, time features directly from the target's transactions—to form a 75-dimensional feature vector (7 time, 60 amount, 8 network features). This representation converts an unbounded transaction graph into a fixed-size, interpretable feature set that a gradient-boosted tree model can train on efficiently.

What would settle it

Take a fresh airdrop dataset, label sybils through an independent process that does not use the same transaction features or clustering heuristics, split into train and test, and rerun the 75-feature LightGBM pipeline; if precision, recall, F1, and AUC drop below the reported range, the original numbers reflected label leakage or overfitting to the labeling method rather than general Sybil detection.

Watch

Extended reading notes

Core claim

The central claim is that Sybil addresses are detectable from the shape and timing of their local transaction neighborhoods, not just from fund-flow clusters. For each address the paper builds a two-hop subgraph above and below it, derives 75 features, and learns a LightGBM classifier. The lifecycle time features capture the compressed, coordinated timing of Sybil creation and activity, while the propagated amount and degree features capture star, chain, and tree topologies characteristic of one controller operating many addresses. The paper reports that this approach beats all baselines on every metric, with all values above 0.9, and that its probability scores refine medium- and low-risk cases that clustering-based methods leave ambiguous.

Load-bearing premise

The entire result rests on the ground-truth Sybil labels being valid and independent of the features the model learns; the paper's labeling process is only summarized, and its relationship to the clustering baseline is not fully disclosed.

Editorial extensions

If this is right

Long-term airdrop campaigns, where labeled Sybil addresses accumulate over time, can move from manually tuned clustering to supervised detection with reported accuracy high enough for production use.
The same 75-feature extraction can be applied to other account-based, EVM-compatible chains without retraining the graph construction, only the classifier.
Feature importance analysis shows that lifecycle timing and total balances drive detection, so attackers who randomize timing or maintain larger balances should become harder to catch.
Because the subgraph is limited to two hops, the method avoids expanding the full transaction graph and keeps computational cost manageable on datasets with tens of millions of transactions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the confirmed-Sybil labels were produced by clustering that resembles the baseline and consumes the same transaction features, the reported metrics may partly measure how well the model reproduces that labeling heuristic; an independent held-out label set would test this.
The lifecycle features are likely transferable to other coordinated-identity problems, such as vote manipulation in DAOs or artificial liquidity in token markets, where the same just-in-time creation pattern appears.
Replacing the hand-set fusion operations (min/max/mean/variance, sum) with learned aggregation, as in graph neural networks, is the natural next step and could push performance beyond the reported AUC while sacrificing some interpretability.
The two-hop window is an implicit assumption about how far Sybil controllers operate from their seed address; checking whether three-hop or cross-chain expansion changes predictions would bound that assumption.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one thing you should know: this is a reasonable feature-engineering paper from the Binance risk team, and it is likely the first supervised treatment of airdrop-specific sybil detection. The central claim — subgraph-based LightGBM beats everything with F1 0.93 and AUC 0.98 — is not supportable from the evaluation as written. The problem is not the method; it's the ground truth and the split.

What's new and useful: the lifecycle timing features (first gas, first tx, first airdrop participation, last tx) are a sensible addition to the usual amount and degree features. The two-layer subgraph propagation is not novel by itself — it's Chen et al.'s cascading trick — but applying it to airdrop sybil detection is new, and the interpretability analysis (top features, star/chain/tree patterns) is a nice touch. The data is real and sizable: 193,701 addresses, 23,240 labeled sybils, 58M transactions from the BAB event. That alone gives the paper practical value.

Where it falls down: Section IV-A says the labels came from "comprehensive manual analysis and clustering methods," but the clustering algorithm, its features, and its parameters are never disclosed. Meanwhile, the strongest baseline, Trusta, is itself community detection on asset transfer graphs plus K-means. If the labeling step used anything close to that, the supervised model is partly learning to imitate the labeler. The appeal process adds a human check, which mitigates the concern somewhat, but it doesn't remove it. You need to know the label-generation features to rule out circularity, and they aren't given.

Second, Table I has no train/test split, no cross-validation, no error bars. With two-layer subgraph features, a random address-level split leaks information: addresses in the same sybil cluster end up on both sides, so the model can peek at neighbors it has already seen. They should hold out whole connected components or a time period. Absent that, the reported metrics do not tell you how the model will generalize to a new sybil campaign.

Third, the baselines are not feature-matched. Plain LightGBM gets first-order features from Farrugia et al.; the proposed model gets two-layer subgraph features. That's a fair comparison of feature extraction, but the paper never ablates to show how much the subgraph features add on top of the same base model.

These are load-bearing flaws, not cosmetic. If I were refereeing, I'd ask for a rewrite with full disclosure of the labeling procedure, a leakage-aware held-out evaluation, and matched baselines. The idea is sound enough to deserve another round. This is not a desk-reject; it's a major-revision candidate.

Who is it for: people working on sybil detection in airdrops and blockchain security practitioners who care about deployable features. Skip if you need a rigorous benchmark.

Recommendation: send to peer review, but expect heavy revision.

Referee Report

4 major / 7 minor

Summary. The paper proposes a supervised method, Subgraph-based LightGBM, for detecting Sybil addresses in blockchain airdrops. The method builds a two-layer transaction subgraph around each address, extracts time, amount, and network-structure features, and fuses features propagated from the subgraph layers. The authors evaluate on a dataset of 193,701 addresses from the BAB airdrop, of which 23,240 are labeled Sybil, and report that their model achieves precision 0.9428, recall 0.9182, F1 0.9303, and AUC 0.9806, outperforming SVM, decision trees, plain LightGBM, and the Clustering-based Trusta baseline. The paper also includes a feature importance analysis and a brief discussion of limitations.

Significance. If the central result holds, the paper would demonstrate that a supervised, subgraph-feature approach can outperform unsupervised clustering for Sybil detection in long-term airdrop campaigns, with a clear and interpretable feature set. The problem is practically important, and the dataset is real and industry-sourced. However, the evaluation as presented lacks the experimental rigor needed to support the claimed >0.9 performance: the ground-truth labeling procedure is not disclosed, no train/test split or cross-validation is reported, baselines are not feature-matched, and the data cleaning removes a meaningful address population. The paper also does not provide code or data, limiting reproducibility. These issues are central to the paper's contribution and require substantial revision.

major comments (4)

[Section IV-A] The ground-truth Sybil labels are described as obtained through 'comprehensive manual analysis and clustering methods,' but the clustering algorithm, its input features, and its parameters are never disclosed. Because the proposed model's features (Section III-A) include transaction graph structure, amount statistics, and temporal lifecycle features, and because the Clustering-based Trusta baseline (Section IV-B) uses community detection and K-means on asset transfer graphs, the reported metrics in Table I may simply measure how well the supervised model reproduces the labeling heuristic rather than its independent detection capability. The authors must disclose the label-generation method or otherwise demonstrate that the labels are independent of the features used by the model, for example by ablating the clustering-derived features and showing that detection remains strong.
[Section IV-C and Table I] No train/test split, cross-validation procedure, or variance estimates are reported for any model in Table I. This is particularly problematic because the two-layer subgraph feature propagation described in Section III-B means that an address's feature vector contains aggregated statistics from its two-hop neighbors; if those neighbors appear in the training set, the model can exploit label information through the graph structure. A random address-level split will place many addresses from the same Sybil cluster in both training and test sets, inflating all metrics. The authors should report evaluation with cluster-level or time-based held-out data and specify the number of Sybil clusters used for splitting.
[Section IV-B] The comparison in Table I is not feature-matched. SVM, DT, and LightGBM are trained on 'first-order features' from Farrugia et al. [24], while the proposed model uses 75 features that include two-layer propagated subgraph features. The reported improvements over the baselines therefore cannot be attributed to the subgraph propagation and fusion method; they may simply reflect a richer feature set. A fair comparison would feed the same feature set to all classifiers, or ablate the propagation module to isolate its contribution.
[Section IV-A] The preprocessing step that removes addresses with lifecycles exceeding one year (2.6% of the dataset) defines away a population that the model is never evaluated on. The authors justify this by arguing that Sybil attackers exhibit high address abandonment, but the consequence is that the reported precision and recall apply only to short-lived addresses. This limitation is not acknowledged in Section V, and it weakens the general claim that the model identifies Sybil addresses in airdrops broadly. The paper should at least discuss the excluded population and whether the model can be expected to handle long-lived Sybil addresses.

minor comments (7)

[General] Figures 1, 2, and 3 are referenced in the text but are not included in the submitted manuscript; please add the figures or remove the references.
[Section III-B] The feature fusion formula is ambiguous: the union operator S is not defined, and the amount-feature count of '2×6×5' is inconsistent with the four statistics (min, max, avg, var) listed in the same section, though Section III-A includes five statistics (adding median). Please clarify the notation and the exact feature count.
[References] Reference [22] is cited twice with different attributions: 'Ramalingam et al. [22]' and 'Chen et al. [22]', while the introduction says the work is inspired by Chen et al. [1]. In addition, references [13] and [24] are duplicates of the same Farrugia et al. paper.
[Section IV-B] The description of the Clustering-based Trusta baseline is incomplete: the authors state that 'time features were prioritized during clustering' but do not specify how the baseline was adapted to this dataset, what parameters were used, or how its risk scores were thresholded to produce labels. Without this, the Trusta comparison is not reproducible.
[Section I] The contribution claim of 'the first application of a supervised machine learning method to sybil address identification' is too strong without a systematic survey to establish novelty; either provide evidence or weaken the claim.
[Section V] The paper's own limitation statement that 'the current model relies on features specific to certain datasets' should be reflected in the abstract, which currently claims broad applicability to 'broader blockchain security areas' without this caveat.
[Section V] The claim of 'lower computational overhead compared to traditional methods' is not supported by any runtime or complexity measurements; please provide experimental evidence or remove the claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the supervised model is trained on labels with an independent manual-review component, and the benchmark comparison is external.

full rationale

The paper does not exhibit a circular derivation. The supervised model is trained on labels that, per Section IV-A, were established by initial clustering followed by reward reclamation and a manual appeal review; the final confirmed labels therefore include a human-review component, so the labels are not definitionally identical to the model's features. The model features (time, amount, network structure) are computed from on-chain transactions, and no equation in Section III-B reduces to a fitted parameter renamed as a prediction. The comparison against Clustering-based Trusta is an external benchmark using the same ground-truth labels, and the concordance analysis in Section IV-C is not used as training input. No load-bearing uniqueness premise is imported from the authors' own prior work, and the cited prior methods are not used to justify the model's core feature set by self-citation. The undisclosed details of the initial clustering heuristic and the absence of an explicit train/test split are legitimate validation and external-validity concerns, but they do not, on the quoted evidence, amount to a by-construction reduction of the claimed predictions to the model's inputs. Therefore no circular step is established.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The paper's contribution rests on hand-crafted features, a proprietary labeling process, and an undisclosed clustering step. The main input that the reader must take on faith is the validity of the ground-truth labels and the fairness of the comparisons, both of which are under-specified.

free parameters (4)

lifecycle threshold filter = 1 year
Addresses with lifecycle exceeding one year are removed from the dataset (2.6% of addresses), a hand-set threshold that changes the evaluation distribution and may remove legitimate long-lived users.
subgraph depth = 2 layers
The method uses a two-layer deep transaction subgraph on both sides (Level -2 to Level 2); the choice of depth determines which neighbors are included in feature propagation and is not justified by analysis.
LightGBM hyperparameters = not reported
No hyperparameter values, tuning procedure, or regularization settings are given; these are effectively fitted to the data.
label-clustering parameters = not reported
The initial sybil labeling used 'manual analysis and clustering methods' with no parameters disclosed; these parameters determine the ground truth labels.

assumptions (3)

domain assumption The appeal-based label is a reliable ground truth for sybil behavior.
Sybil positives are defined as addresses that did not appeal or whose appeals were rejected; this is an administrative procedure, not an independent verification of the true label.
domain assumption Two-layer transaction subgraphs are sufficient to capture sybil behavior patterns.
The method assumes that relevant information is contained within two hops of the target address; no ablation on depth is presented.
domain assumption Baseline models are implemented and compared fairly.
The paper compares against SVM, DT, LightGBM, and Trusta, but provides no implementation details, hyperparameters, or feature sets beyond a reference for first-order features, so fairness cannot be assessed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach." pith.science (2026). https://pith.science/paper/2J3ONOLM

@misc{pith2026250509313,
  author       = {Pith},
  title        = {Pith review of: Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2J3ONOLM}},
  note         = {Machine review of arXiv:2505.09313}
}

read the original abstract

Sybil attacks pose a significant security threat to blockchain ecosystems, particularly in token airdrop events. This paper proposes a novel sybil address identification method based on subgraph feature extraction lightGBM. The method first constructs a two-layer deep transaction subgraph for each address, then extracts key event operation features according to the lifecycle of sybil addresses, including the time of first transaction, first gas acquisition, participation in airdrop activities, and last transaction. These temporal features effectively capture the consistency of sybil address behavior operations. Additionally, the method extracts amount and network structure features, comprehensively describing address behavior patterns and network topology through feature propagation and fusion. Experiments conducted on a dataset containing 193,701 addresses (including 23,240 sybil addresses) show that this method outperforms existing approaches in terms of precision, recall, F1 score, and AUC, with all metrics exceeding 0.9. The methods and results of this study can be further applied to broader blockchain security areas such as transaction manipulation identification and token liquidity risk assessment, contributing to the construction of a more secure and fair blockchain ecosystem.

Figures

Figures reproduced from arXiv: 2505.09313 by the authors.

**Figure 2.** Example of 2 levels features fusion. wallet addresses and contract addresses, as these are unlikely to be sybil addresses. 2) Retaining transactions distributed by contracts, as this represents a common sybil address pattern where funds are sent to multiple addresses in a single transaction through contract distribution protocols. 3) Filtering out addresses with lifecycles exceeding one year (accounting for 2.6% of… view at source ↗

**Figure 3.** illustrates the top 10 most important features extracted using our subgraph-based method. Key findings from our analysis include: • participate activity date/first tx date/get gas date: These three features represent the time of first participation in an airdrop activity, first transaction, and first gas fund receipt, respectively. For sybil addresses, there is a notable temporal clustering in their operational beha… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 20 canonical work pages

[24]

Farrugia, J

S. Farrugia, J. Ellul, and G. Azzopardi, ”Detection of illicit accounts over the Ethereum blockchain,” Expert Syst. Appl., vol. 150, p. 113318, 2020

work page 2020
[1]

W. Chen, Z. Zheng, J. Cui, E. Ngai, P. Zheng, and Y . Zhou, ”Phishing scam detection on Ethereum: Towards financial security for blockchain ecosystem,” IJCAI, vol. 7, 2020

work page 2020
[3]

J. Xu, D. Xiang, Q. Yan, L. Wang, and G. Han, ”Gsan: Graph self- attention network for learning spatial-temporal interaction patterns in bitcoin transaction networks,” IEEE Trans. Netw. Sci. Eng., vol. 9, no. 1, pp. 204-217, 2021

work page 2021
[4]

Victor and B

F. Victor and B. K. L ¨uders, ”Measuring ethereum-based erc20 token networks,” in Proc. Int. Conf. Financial Cryptography Data Security, 2019, pp. 113-129

work page 2019
[5]

Zhang, C

Y . Zhang, C. Wang, X. Gao, S. Guo, and X. Dong, ”When blockchain meets big data: A new paradigm,” Big Data Research, vol. 25, p. 100234, 2021

work page 2021
[6]

Jourdan, S

M. Jourdan, S. Blandin, L. Wynter, and P. Deshpande, ”A probabilistic model of the bitcoin blockchain,” in Proc. IEEE Conf. Comput. Com- mun. Workshops (INFOCOM WKSHPS), 2018, pp. 1-6

work page 2018
[7]

X. Li, X. Wang, G. Yu, Y . Liu, and D. Feng, ”FedEC: A new paradigm for entity classification in blockchain,” IEEE Trans. Syst., Man, Cybern., Syst., vol. 53, no. 3, pp. 1859-1870, 2023

work page 2023
[8]

Biryukov and S

A. Biryukov and S. Tikhomirov, ”Deanonymization and linkability of cryptocurrency transactions based on network analysis,” in Proc. IEEE European Symp. Security Privacy (EuroS&P), 2019, pp. 172-184

work page 2019

Show all 22 references

[9]

Tzanetakis, G

M. Tzanetakis, G. Kamphausen, B. Werse, and R. von Laufenberg, ”The digital transformation of drug markets: An analysis of the supply-side of cryptomarkets,” J. Illicit Economies Development, vol. 3, no. 2, pp. 194-212, 2022

2022
[10]

Victor, ”Address clustering heuristics for Ethereum,” in Proc

F. Victor, ”Address clustering heuristics for Ethereum,” in Proc. Int. Conf. Financial Cryptography Data Security, 2020

2020
[11]

Payette, S

J. Payette, S. Schwager, and J. Murphy, ”Characterizing the ethereum address space,” Available at SSRN 2965684, 2017

2017
[12]

Y . Hu, S. Seneviratne, K. Thilakarathna, K. Fukuda, and A. Seneviratne, ”Characterizing and detecting money laundering activities on the bitcoin network,” arXiv preprint arXiv:1912.12060, 2019

1912 arXiv
[14]

J. Wu, Q. Yuan, D. Lin, W. You, W. Chen, C. Chen, and Z. Zheng, ”Who are the phishers? Phishing scam detection on ethereum via network embedding,” IEEE Trans. Syst., Man, Cybern., Syst., vol. 52, no. 2, pp. 1156-1166, 2020

2020
[15]

Jourdan, S

M. Jourdan, S. Blandin, L. Wynter, and P. Deshpande, ”Characterizing entities in the bitcoin blockchain,” in Proc. IEEE Int. Conf. Data Mining Workshops (ICDMW), 2018

2018
[16]

D. Lin, J. Wu, Q. Yuan, and Z. Zheng, ”Modeling and understanding ethereum transaction records via a complex network approach,” IEEE Trans. Circuits Syst. II, Exp. Briefs, vol. 67, no. 11, pp. 2737-2741, 2020

2020
[17]

Chauhan, O

A. Chauhan, O. P. Malviya, M. Verma, and T. S. Mor, ”Blockchain and scalability,” in Proc. IEEE Int. Conf. Softw. Quality, Rel. Security Companion (QRS-C), 2018

2018
[18]

Toyoda, T

K. Toyoda, T. Ohtsuki, and P. T. Mathiopoulos, ”Identification of high yielding investment programs in bitcoin via transactions pattern analysis,” in Proc. IEEE Global Commun. Conf. (GLOBECOM), 2017

2017
[19]

Baumann, B

A. Baumann, B. Fabian, and M. Lischke, ”Exploring the Bitcoin network,” in Proc. WEBIST, vol. 1, 2014, pp. 369-374

2014
[20]

Liu and H

Z. Liu and H. Zhu, ”Fighting Sybils in Airdrops,” arXiv preprint arXiv:2209.04603, 2022

2022 arXiv
[21]

Kanezashi, K

H. Kanezashi, K. Hirose, Y . Ike, K. Sano, and T. Yada, ”Ethereum fraud detection with heterogeneous graph neural networks,” arXiv preprint arXiv:2203.12363, 2022

2022 arXiv
[22]

Ramalingam and V

D. Ramalingam and V . Chinnaiah, ”Fake profile detection techniques in large-scale online social networks: A comprehensive review,” Comput. Elect. Eng., vol. 65, pp. 165-177, 2018

2018
[23]

R. Yang, T. Murray, P. Rimba, and U. Parampalli, ”Empirically analyzing ethereum’s gas mechanism,” in Proc. IEEE European Symp. Security Privacy Workshops (EuroS&PW), 2019

2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [24]

Farrugia, J

S. Farrugia, J. Ellul, and G. Azzopardi, ”Detection of illicit accounts over the Ethereum blockchain,” Expert Syst. Appl., vol. 150, p. 113318, 2020

work page 2020

[2] [1]

W. Chen, Z. Zheng, J. Cui, E. Ngai, P. Zheng, and Y . Zhou, ”Phishing scam detection on Ethereum: Towards financial security for blockchain ecosystem,” IJCAI, vol. 7, 2020

work page 2020

[3] [3]

J. Xu, D. Xiang, Q. Yan, L. Wang, and G. Han, ”Gsan: Graph self- attention network for learning spatial-temporal interaction patterns in bitcoin transaction networks,” IEEE Trans. Netw. Sci. Eng., vol. 9, no. 1, pp. 204-217, 2021

work page 2021

[4] [4]

Victor and B

F. Victor and B. K. L ¨uders, ”Measuring ethereum-based erc20 token networks,” in Proc. Int. Conf. Financial Cryptography Data Security, 2019, pp. 113-129

work page 2019

[5] [5]

Zhang, C

Y . Zhang, C. Wang, X. Gao, S. Guo, and X. Dong, ”When blockchain meets big data: A new paradigm,” Big Data Research, vol. 25, p. 100234, 2021

work page 2021

[6] [6]

Jourdan, S

M. Jourdan, S. Blandin, L. Wynter, and P. Deshpande, ”A probabilistic model of the bitcoin blockchain,” in Proc. IEEE Conf. Comput. Com- mun. Workshops (INFOCOM WKSHPS), 2018, pp. 1-6

work page 2018

[7] [7]

X. Li, X. Wang, G. Yu, Y . Liu, and D. Feng, ”FedEC: A new paradigm for entity classification in blockchain,” IEEE Trans. Syst., Man, Cybern., Syst., vol. 53, no. 3, pp. 1859-1870, 2023

work page 2023

[8] [8]

Biryukov and S

A. Biryukov and S. Tikhomirov, ”Deanonymization and linkability of cryptocurrency transactions based on network analysis,” in Proc. IEEE European Symp. Security Privacy (EuroS&P), 2019, pp. 172-184

work page 2019