{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T16:53:45Z","timestamp":1783097625029,"version":"3.54.6"},"reference-count":49,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2021,12,22]],"date-time":"2021-12-22T00:00:00Z","timestamp":1640131200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"crossref","award":["U1836207"],"award-info":[{"award-number":["U1836207"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"crossref","award":["2019YFE0103800"],"award-info":[{"award-number":["2019YFE0103800"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"crossref","award":["2020M670998"],"award-info":[{"award-number":["2020M670998"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Web"],"published-print":{"date-parts":[[2022,5,31]]},"abstract":"<jats:p>Exploiting the anonymous mechanism of Bitcoin, ransomware activities demanding ransom in bitcoins have become rampant in recent years. Several existing studies quantify the impact of ransomware activities, mostly focusing on the amount of ransom. However, victims\u2019 reactions in Bitcoin that can well reflect the impact of ransomware activities are somehow largely neglected. Besides, existing studies track ransom transfers at the Bitcoin address level, making it difficult for them to uncover the patterns of ransom transfers from a macro perspective beyond Bitcoin addresses.<\/jats:p>\n          <jats:p>\n            In this article, we conduct a large-scale analysis of ransom payments, ransom transfers, and victim migrations in Bitcoin from 2012 to 2021. First, we develop a fine-grained address clustering method to cluster Bitcoin addresses into users, which enables us to identify more addresses controlled by ransomware criminals. Second, motivated by the fact that Bitcoin activities and their participants already formed stable industries, such as\n            <jats:sans-serif>Darknet<\/jats:sans-serif>\n            and\n            <jats:sans-serif>Miner<\/jats:sans-serif>\n            , we train a multi-label classification model to identify the industry identifiers of users. Third, we identify ransom payment transactions and then quantify the amount of ransom and the number of victims in 63 ransomware activities. Finally, after we analyze the trajectories of ransom transferred across different industries and track victims\u2019 migrations across industries, we find out that to obscure the purposes of their transfer trajectories, most ransomware criminals (e.g., operators of Locky and Wannacry) prefer to spread ransom into multiple industries instead of utilizing the services of Bitcoin mixers. Compared with other industries,\n            <jats:sans-serif>Investment<\/jats:sans-serif>\n            is highly resilient to ransomware activities in the sense that the number of users in\n            <jats:sans-serif>Investment<\/jats:sans-serif>\n            remains relatively stable. Moreover, we also observe that a few victims become active in the\n            <jats:sans-serif>Darknet<\/jats:sans-serif>\n            after paying ransom. Our findings in this work can help authorities deeply understand ransomware activities in Bitcoin. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal activities that have similarly adopted bitcoins as their payments.\n          <\/jats:p>","DOI":"10.1145\/3494557","type":"journal-article","created":{"date-parts":[[2021,12,22]],"date-time":"2021-12-22T18:19:01Z","timestamp":1640197141000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":21,"title":["A Large-scale Empirical Analysis of Ransomware Activities in Bitcoin"],"prefix":"10.1145","volume":"16","author":[{"given":"Kai","family":"Wang","sequence":"first","affiliation":[{"name":"School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Pang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Luxembourg, Luxembourg"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dingjie","family":"Chen","sequence":"additional","affiliation":[{"name":"Software School, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yu","family":"Zhao","sequence":"additional","affiliation":[{"name":"Software School, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dapeng","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chen","family":"Chen","sequence":"additional","affiliation":[{"name":"Software School, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Weili","family":"Han","sequence":"additional","affiliation":[{"name":"Software School, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,12,22]]},"reference":[{"key":"e_1_3_2_2_2","first-page":"1","volume-title":"Proceedings of the 5th Workshop on Graphical Models for Security","author":"Ahmed Mansoor","year":"2018","unstructured":"Mansoor Ahmed, Ilia Shumailov, and Ross Anderson. 2018. Tendrils of crime: Visualizing the diffusion of stolen bitcoins. In Proceedings of the 5th Workshop on Graphical Models for Security. Springer, 1\u201312."},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.5555\/3491440.3492052"},{"issue":"4","key":"e_1_3_2_4_2","first-page":"675","article-title":"Bitcoin pricing, adoption, and usage: Theory and evidence","volume":"13","author":"Athey Susan","year":"2016","unstructured":"Susan Athey, Ivo Parashkevov, Vishnu Sarukkai, and Jing Xia. 2016. Bitcoin pricing, adoption, and usage: Theory and evidence. Stanf. Inst. Econ. Pol. Res. 13, 4 (2016), 675\u2013746.","journal-title":"Stanf. Inst. Econ. Pol. Res."},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.5555\/525960"},{"key":"e_1_3_2_6_2","volume-title":"Proceedings of the 2nd Italian Conference on Cyber Security (ITASEC\u201918)","author":"Bistarelli Stefano","year":"2018","unstructured":"Stefano Bistarelli, Matteo Parroccini, and Francesco Santini. 2018. Visualizing bitcoin flows of ransomware: Wannacry one week later. In Proceedings of the 2nd Italian Conference on Cyber Security (ITASEC\u201918)."},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2807452"},{"key":"e_1_3_2_8_2","first-page":"166","volume-title":"Proceedings of the 6th Conference on Complex Networks and Their Applications (Complex Networks)","author":"Cazabet R\u00e9my","year":"2017","unstructured":"R\u00e9my Cazabet, Rym Baccour, and Matthieu Latapy. 2017. Tracking bitcoin users activity using community detection on a network of weak signals. In Proceedings of the 6th Conference on Complex Networks and Their Applications (Complex Networks). Springer, 166\u2013177."},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737364"},{"key":"e_1_3_2_10_2","article-title":"Ransomware Is Now Big Business on the Dark Web and Malware Developers Are Cashing in","author":"Cimpanu Catalin","year":"2017","unstructured":"Catalin Cimpanu. 2017. Ransomware Is Now Big Business on the Dark Web and Malware Developers Are Cashing in. Retrieved from https:\/\/www.zdnet.com\/article\/ransomware-is-now-big-business-on-the-dark-web-and-malware-developers-are-cashing-in\/.","journal-title":"https:\/\/www.zdnet.com\/article\/ransomware-is-now-big-business-on-the-dark-web-and-malware-developers-are-cashing-in\/"},{"key":"e_1_3_2_11_2","article-title":"Bitcoin Plummets 20 after Major Exchange Halts Withdrawals","author":"Clinch Matt","year":"2014","unstructured":"Matt Clinch. 2014. Bitcoin Plummets 20 after Major Exchange Halts Withdrawals. Retrieved from https:\/\/www.cnbc.com\/2014\/02\/07\/bitcoin-plummets-20-after-major-exchange-halts-withdrawals.html.","journal-title":"https:\/\/www.cnbc.com\/2014\/02\/07\/bitcoin-plummets-20-after-major-exchange-halts-withdrawals.html"},{"key":"e_1_3_2_12_2","article-title":"US Offers up to $10 Million Reward for Information on Cyberattacks against Critical Infrastructure by Foreign States","year":"2021","unstructured":"CNN. 2021. US Offers up to $10 Million Reward for Information on Cyberattacks against Critical Infrastructure by Foreign States. Retrieved from https:\/\/www.cnn.com\/2021\/07\/15\/politics\/us-state-department-reward-cyberattacks\/index.html.","journal-title":"https:\/\/www.cnn.com\/2021\/07\/15\/politics\/us-state-department-reward-cyberattacks\/index.html"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.08.008"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/SADFE51007.2020.00013"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1038\/ncomms8366"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1093\/rfs\/hhz015"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0092-2"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.122653799"},{"key":"e_1_3_2_19_2","article-title":"Google Trends","year":"2021","unstructured":"Google. 2021. Google Trends. Retrieved from https:\/\/trends.google.com\/trends\/.","journal-title":"https:\/\/trends.google.com\/trends\/"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.5555\/3294771.3294869"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-85928-2_9"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00047"},{"key":"e_1_3_2_23_2","article-title":"Coinjoinmess","author":"Janda Ale\u0161","year":"2021","unstructured":"Ale\u0161 Janda. 2021. Coinjoinmess. Retrieved from https:\/\/www.walletexplorer.com\/wallet\/CoinJoinMess.","journal-title":"https:\/\/www.walletexplorer.com\/wallet\/CoinJoinMess"},{"key":"e_1_3_2_24_2","article-title":"Walletexplorer.com","author":"Janda Ale\u0161","year":"2021","unstructured":"Ale\u0161 Janda. 2021. Walletexplorer.com. Retrieved from https:\/\/www.walletexplorer.com.","journal-title":"https:\/\/www.walletexplorer.com"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.avb.2011.09.003"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.5555\/3489212.3489365"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277238"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1080\/01639625.2015.1060796"},{"key":"e_1_3_2_29_2","article-title":"Hackers Who Infected 200,000 Machines Have Only Made $50,000 Worth of Bitcoin","author":"Kharpal Arjun","year":"2017","unstructured":"Arjun Kharpal. 2017. Hackers Who Infected 200,000 Machines Have Only Made $50,000 Worth of Bitcoin. Retrieved from https:\/\/www.cnbcafrica.com\/technology\/2017\/05\/16\/hackers-made-50000-worth-bitcoin\/.","journal-title":"https:\/\/www.cnbcafrica.com\/technology\/2017\/05\/16\/hackers-made-50000-worth-bitcoin\/"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20550-2_1"},{"key":"e_1_3_2_31_2","article-title":"Wannacry: Are You Safe?","author":"Lab A. O. Kaspersky","year":"2021","unstructured":"A. O. Kaspersky Lab. 2021. Wannacry: Are You Safe? Retrieved from https:\/\/www.kaspersky.com\/blog\/wannacry-ransomware\/16518\/.","journal-title":"https:\/\/www.kaspersky.com\/blog\/wannacry-ransomware\/16518\/"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23055"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/ECRIME.2016.7487938"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504747"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101762"},{"issue":"4","key":"e_1_3_2_36_2","first-page":"436","article-title":"Listening to whispers of ripple: Linking wallets and deanonymizing transactions in the ripple network","volume":"2016","author":"Moreno-Sanchez Pedro","year":"2016","unstructured":"Pedro Moreno-Sanchez, Muhammad Bilal Zafar, and Aniket Kate. 2016. Listening to whispers of ripple: Linking wallets and deanonymizing transactions in the ripple network. Proc. Priv. Enhanc. Technol. 2016, 4 (2016), 436\u2013453.","journal-title":"Proc. Priv. Enhanc. Technol."},{"key":"e_1_3_2_37_2","unstructured":"Satoshi Nakamoto. 2009. Bitcoin: A Peer-to-Peer Electronic Cash System. Retrieved from https:\/\/bitcoin.org\/bitcoin.pdf."},{"key":"e_1_3_2_38_2","article-title":"Bitcoin Forum","author":"Nakamoto Satoshi","year":"2009","unstructured":"Satoshi Nakamoto. 2009. Bitcoin Forum. Retrieved from https:\/\/bitcointalk.org.","journal-title":"https:\/\/bitcointalk.org"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-020-02048-w"},{"key":"e_1_3_2_40_2","article-title":"The Concept of Industry","author":"Omidyar Pierre","year":"2021","unstructured":"Pierre Omidyar. 2021. The Concept of Industry. Retrieved from https:\/\/en.wikipedia.org\/wiki\/Industry_(economics).","journal-title":"https:\/\/en.wikipedia.org\/wiki\/Industry_(economics)"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyz003"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1038\/srep25570"},{"key":"e_1_3_2_43_2","article-title":"ID Ransomware","author":"Ransomware ID","year":"2021","unstructured":"ID Ransomware. 2021. ID Ransomware. Retrieved from https:\/\/id-ransomware.malwarehunterteam.com\/.","journal-title":"https:\/\/id-ransomware.malwarehunterteam.com\/"},{"key":"e_1_3_2_44_2","article-title":"Bitcoin Gamblers Have Wagered $4.5 Billion in BTC Since 2014","author":"Redman Jamie","year":"2017","unstructured":"Jamie Redman. 2017. Bitcoin Gamblers Have Wagered $4.5 Billion in BTC Since 2014. Retrieved from https:\/\/news.bitcoin.com\/bitcoin-gamblers-wagered-4-5-billion-btc-2014\/.","journal-title":"https:\/\/news.bitcoin.com\/bitcoin-gamblers-wagered-4-5-billion-btc-2014\/"},{"key":"e_1_3_2_45_2","article-title":"Bitcoinabusedataset","author":"Reed Alan","year":"2021","unstructured":"Alan Reed. 2021. Bitcoinabusedataset. Retrieved from https:\/\/www.bitcoinabuse.com\/.","journal-title":"https:\/\/www.bitcoinabuse.com\/"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/PASSAT\/SocialCom.2011.79"},{"key":"e_1_3_2_47_2","article-title":"Ethonym","author":"Salber Paul","year":"2021","unstructured":"Paul Salber and Paul Elosegui. 2021. Ethonym. Retrieved from https:\/\/ethonym.com.","journal-title":"https:\/\/ethonym.com"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-45472-5_29"},{"issue":"1","key":"e_1_3_2_49_2","first-page":"1","article-title":"Extreme risk induced by communities in interdependent networks","volume":"2","author":"Sun Jiachen","year":"2019","unstructured":"Jiachen Sun, Rui Zhang, Ling Feng, Christopher Monterola, Xiao Ma, C\u00e9line Rozenblat, H Eugene Stanley, Boris Podobnik, and Yanqing Hu. 2019. Extreme risk induced by communities in interdependent networks. Commun. Phys. 2, 1 (2019), 1\u20137.","journal-title":"Commun. Phys."},{"key":"e_1_3_2_50_2","first-page":"1061","volume-title":"Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)","author":"Zhang-Kennedy Leah","year":"2018","unstructured":"Leah Zhang-Kennedy, Hala Assal, Jessica N. Rocheleau, Reham Mohamed, Khadija Baig, and Sonia Chiasson. 2018. The aftermath of a crypto-ransomware attack at a large academic institution. In Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918). USENIX Association, 1061\u20131078."}],"container-title":["ACM Transactions on the Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3494557","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3494557","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:48:43Z","timestamp":1750193323000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3494557"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,12,22]]},"references-count":49,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2022,5,31]]}},"alternative-id":["10.1145\/3494557"],"URL":"https:\/\/doi.org\/10.1145\/3494557","relation":{},"ISSN":["1559-1131","1559-114X"],"issn-type":[{"value":"1559-1131","type":"print"},{"value":"1559-114X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,12,22]]},"assertion":[{"value":"2021-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-10-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-12-22","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}