Follow the vine to get the melon: A deep framework for blockchain phishing fraud detection

Blockchain phishing frauds have caused significant financial losses and eroded trust in blockchain platforms. While existing detection methods increasingly rely on mining transaction networks to identify fraudsters, they often fail to fully exploit transaction patterns or sufficiently model label dependencies—whether between victims and fraudsters or among fraudsters themselves. Informed by criminology theories, we develop a deep learning framework—DeepPhishDetect—that integrates both effective node representation learning and label dependency modeling across transaction networks. DeepPhishDetect models the joint distribution of object labels with a conditional random field (CRF), which can be effectively trained with the variational expectation maximization (EM) framework. Specifically, we design a novel Deep Multi-faceted Detector (DMFD) module to learn complex transactional features in E -step and adopt a Graph Attention Network (GAT) model to profile the label dependencies between fraudsters and victims or among fraudsters in M-step. Experimental results show that DeepPhishDetect significantly outperforms state-of-the-art blockchain phishing detection methods. An ablation study further validates the key design of our model. Intriguingly, a case study demonstrates that our model not only improves accuracy in detecting known phishing accounts but also identifies highly suspicious actors previously overlooked by existing labels. This work contributes to the cybersecurity literature by offering an innovative and more accurate blockchain phishing detection method and enhances business practices in blockchain platform regulation through proactive risk management. • A novel deep learning framework—DeepPhishDetect—detects blockchain phishing using both effective node representation learning and label dependency modeling. • Co-offending theory and routine activity theory motivate our design. • A novel Deep Multi-faceted Detector (DMFD) model learns complex transactional features in E-step and a Graph Attention Network (GAT) profiles the label dependencies in M-step. • DeepPhishDetect improves accuracy and uncovers suspicious blockchain phishing fraudsters missed by current methods.