BlockAthena: A Scalable Approach for Long-Term Blockchain Crimes Analysis

With the advent of blockchain, on-chain crimes such as phishing, fraud, and cryptocurrency heist can be severe. Stealthy on-chain crimes tend to adopt Advanced Persistent Threat (APT) tactics to avoid detection, characterized by long-term persistence and ever-evolving crime patterns. However, existing forensic approaches struggle with scalability as the time span of on-chain crimes grows. To address this limitation, we propose BlockAthena, the first scalable forensic framework for long-term on-chain crime analysis in account-based blockchains. We first observe that real-world on-chain crimes tend to exhibit botnet-style behaviors and APT-like life-cycles in the long-term perspective, characterized as co-occurrence transactional behaviors and latent periodicity (e.g., crime preparation, exploitation, and propagation stages). Inspired by these insights, BlockAthena segments long-term transaction topology into semantically complete subgraphs based on crime periodicity (i.e., evolution periods) and models both direct and co-occurrence transactional behaviors within segment subgraphs, enhancing memory efficiency while preserving key behavioral traits. Specifically, BlockAthena consists of three key components: (i) a Motif-aware Periodicity Modeling (MPM) module that performs joint analysis in the wavelet-topology domain to extract crime evolution periods; (ii) a mixed-order behavior profiler that captures fine-grained temporal dynamics and botnet-style co-occurrence transactions via dynamic graph mining and hypergraph modeling; and (iii) an Evolution-aware Residual Aggregator (ERA) that synthesizes long-term patterns across evolution periods using residual connections. Extensive experiments validate the effectiveness and scalability of BlockAthena, achieving an average 18% improvement in F1-score and up to an 80% reduction in memory overhead compared to the best-performing baseline. The real-world case study further demonstrates its capability to uncover APT-style stealthy tactics in long-term on-chain crimes.