Abstract: Ethereum, as the second generation of blockchain technology, it not only brings many advantages, but also spawns various malicious incidents. Ethereum’s anonymity makes it a hotbed of cybercrime, causing huge losses to users and severely disrupting the Ethereum ecosystem. To this end, this paper proposes a method for detecting malicious accounts in Ethereum based on ETH tracking tree (ETH-TT). Firstly, based on the transaction history replay mechanism, an ETH tracking algorithm for tracking the transaction amount of Ethereum is designed to obtain the ETH tracking tree, and extract sequence features from it. Then train the LSTM model to reduce the dimension of the sequence features to obtain the output features. Finally, detection is done by a machine learning classifier, fused with manual features from account transaction history. We uses 5576 malicious accounts and 4968 normal accounts as dataset for experiments. The results show that the ETH-TT method can achieve an F1-score of 95.4% with the cooperation of the XGBoost classifier, which is better than the detection method using only manual features.