김유진, 윤지원,

Vol. 35, No. 3, pp. 463-476, 6월. 2025
10.13089/JKIISC.2025.35.3.463, Full Text:
Keywords: Bitcoin, cryptocurrency crime, transaction pattern analysis, cybersecurity, pattern recognition
Abstract

This study explores how the decentralized and anonymous nature of Bitcoin contributes to the rise of cybercrimes such as ransomware, sextortion, tumblers, and blackmail scams. Using data from major reporting platforms and blockchain explorers, we collected 347,779 suspicious addresses between January 2017 and June 2024. After removing duplicates, we analyzed 1,000 addresses for each crime type. To understand the patterns behind these crimes, we applied a combination of time series and network analysis. Our findings show that ransomware wallets transact at an average of 0.9 times per hour—roughly 45 times more than legitimate wallets. Tumblers maintain a high transaction rate with noticeable periodic spikes. Sextortion addresses, while quieter overall, show sudden bursts of activity, and blackmail scams are marked by irregular, unstable flows. Notably, wallets associated with different crimes tend to correlate with each other (correlation coefficients of 0.65–0.70), while their similarity to legitimate traffic is minimal (under 0.2). These results highlight that criminal wallets behave in distinct and recognizable ways, different from regular users. The framework we propose may help flag suspicious activity early and even predict major laundering attempts. Still, since this study focuses only on Bitcoin, future work should include other coins and explore deep learning approaches to better capture evolving tactics.

Statistics
Cite this article