Cybercriminal Minds: An investigative study of cryptocurrency abuses in the Dark Web

Seungwon Shin, Changhoon Yoon, Seunghyeon Lee, Yongdae Kim, Dongsu Han, Sooel Son

Abstract:

—The Dark Web is notorious for being a major
distribution channel of harmful content as well as unlawful goods.
Perpetrators have also used cryptocurrencies to conduct illicit
financial transactions while hiding their identities. The limited
coverage and outdated data of the Dark Web in previous studies
motivated us to conduct an in-depth investigative study to understand how perpetrators abuse cryptocurrencies in the Dark Web.
We designed and implemented MFScope, a new framework which
collects Dark Web data, extracts cryptocurrency information, and
analyzes their usage characteristics on the Dark Web. Specifically,
MFScope collected more than 27 million dark webpages and
extracted around 10 million unique cryptocurrency addresses for
Bitcoin, Ethereum, and Monero. It then classified their usages to
identify trades of illicit goods and traced cryptocurrency money
flows, to reveal black money operations on the Dark Web. In
total, using MFScope we discovered that more than 80% of
Bitcoin addresses on the Dark Web were used with malicious
intent; their monetary volume was around 180 million USD,
and they sent a large sum of their money to several popular
cryptocurrency services (e.g., exchange services). Furthermore,
we present two real-world unlawful services and demonstrate
their Bitcoin transaction traces, which helps in understanding
their marketing strategy as well as black money operations.