Ransomwise: A Transaction-Based Dataset for Ransomware Bitcoin Wallet Detection

In this paper, we introduce Ransomwise: an extensive, qualitative, and representative dataset for transaction-based ransomware wallet detection. Ransomwise comprises 10 trusted public ransomware sources, incorporating over 20K ransomware wallets active between 2015 and 2024, with 136K transactions in total. We demonstrate the usefulness of our proposed dataset by extracting aggregated wallet features and training simple tree-based models, all of which achieve at least 85% accuracy and 78% precision in identifying ransomware wallets (even with their depth constrained to 3). Moreover, we enrich our analysis with a time-based evaluation protocol, highlighting the importance of data collection across years from multiple sources. Ransomwise dataset, along with our evaluation methodology, can accelerate advances in ransomware detection and analysis research.