[论文解读] Unveiling the Risks of NFT Promotion Scams

Sayak Saha Roy, Dipanjan Das+4 more|arXiv (Cornell University)|Jan 24, 2023

Cybercrime and Law Enforcement Studies被引用 8

一句话总结

该论文对439个在推特上进行NFT推广的账号进行纵向分析，涉及823个NFT项目，发现超过36%为欺诈，并开发了一个ML检测器，识别出382个新的欺诈项目，同时评估反诈骗措施及其财政影响。

ABSTRACT

The rapid growth in popularity and hype surrounding digital assets such as art, video, and music in the form of non-fungible tokens (NFTs) has made them a lucrative investment opportunity, with NFT-based sales surpassing $25B in 2021 alone. However, the volatility and general lack of technical understanding of the NFT ecosystem have led to the spread of various scams. The success of an NFT heavily depends on its online virality. As a result, creators use dedicated promotion services to drive engagement to their projects on social media websites, such as Twitter. However, these services are also utilized by scammers to promote fraudulent projects that attempt to steal users' cryptocurrency assets, thus posing a major threat to the ecosystem of NFT sales. In this paper, we conduct a longitudinal study of 439 promotion services (accounts) on Twitter that have collectively promoted 823 unique NFT projects through giveaway competitions over a period of two months. Our findings reveal that more than 36% of these projects were fraudulent, comprising of phishing, rug pull, and pre-mint scams. We also found that a majority of accounts engaging with these promotions (including those for fraudulent NFT projects) are bots that artificially inflate the popularity of the fraudulent NFT collections by increasing their likes, followers, and retweet counts. This manipulation results in significant engagement from real users, who then invest in these scams. We also identify several shortcomings in existing anti-scam measures, such as blocklists, browser protection tools, and domain hosting services, in detecting NFT-based scams. We utilized our findings to develop a machine learning classifier tool that was able to proactively detect 382 new fraudulent NFT projects on Twitter.

研究动机与目标

• 描述推特上NFT promotions如何为了欺诈项目而抬高互动水平。
• 评估现有反诈骗措施（阻止清单、浏览器保护、托管等）对NFT诈骗的有效性。
• 通过区块链交易追踪量化被推广NFT诈骗的财政影响。
• 开发并评估一种机器学习分类器，以主动检测推特上的欺诈NFT项目。

提出的方法

• 通过分析个人资料关键词和大量关注者来识别NFT推广账户。
• 收集并标注2022年6月至8月间被推广的推特推广推文和NFT项目。
• 基于行为与网站分析，将欺诈项目手动标注为钓鱼、金字塔骗局或预铸。
• 使用Botometer在多个阈值下跟踪参与度指标（关注者、转发、点赞）和机器人活动。
• 通过检查Google Safe Browsing、APWG、PhishTank、OpenPhish和VirusTotal的检测情况，评估反诈骗工具覆盖率。
• 追踪区块链交易以量化转移至攻击者钱包的资金。
• 构建一个真实世界的钓鱼URL数据集，结合基于DNS-twist的发现与NFT特定URL发现用于ML训练。
• 训练并评估ML模型（决策树、逻辑回归、SVM、随机森林）用于钓鱼URL检测；选择随机森林作为最佳。

Figure 1: Example of a promotion tweet shared by an NFT promoter account advertising a sweepstake competition for a period of one day. Users who retweet this tweet and follow the tagged NFT project have a chance to win $1.45J$ (million) worth of a cryptocurrency token worth $100

实验结果

研究问题

• RQ1 RQ1：在推特上进行推广的欺诈NFT账户有哪些特征与可见性？
• RQ2 RQ2：普遍的反诈措施在检测这些攻击方面有多大有效性？
• RQ3 RQ3：这些骗局的财政影响有多大？

主要发现

• 被推广的NFT项目中有超过36%是欺诈行为（钓鱼、金字塔骗局、预铸）。
• 参与推广的账户大多为机器人，负责抬高互动与关注者数量。
• 大量被推广的骗局被移除（18.1%）或暂停（8.9%），其中许多模仿合法的收藏品。
• 机器人显著促成了推广以及随后真实用户的互动，可能推动资金损失。
• 反诈骗措施（阻止清单、浏览器保护）在检测基于NFT的诈骗方面存在缺口。
• ML分类器在检测钓鱼URL方面达到0.97的准确率、0.95的精确率和0.98的召回率；Top特征包括对Etherscan/合约的检查和Twitter指标。
• 观察到推广活动与随后的钱包互动之间存在一对多关系，使诈骗能够获取真实资金。

Figure 2: Cumulative distribution of followers gained by Active, Removed, and Suspended NFT accounts that were promoted.