Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem
Abstract
In the past year, a new spamming scheme has emerged: sexual extortion messages requiring payments in the cryptocurrency Bitcoin, also known as sextortion. This scheme represents a first integration of the use of cryptocurrencies by members of the spamming industry. Using a dataset of 4,340,736 sextortion spams, this research aims at understanding such new amalgamation by uncovering spammers' operations. To do so, a simple, yet effective method for projecting Bitcoin addresses mentioned in sextortion spams onto transaction graph abstractions is computed over the entire Bitcoin blockchain. This allows us to track and investigate monetary flows between involved actors and gain insights into the financial structure of sextortion campaigns. We find that sextortion spammers are somewhat sophisticated, following pricing strategies and benefiting from cost reductions as their operations cut the upper-tail of the spamming supply chain. We discover that one single entity is likely controlling the financial backbone of the majority of the sextortion campaigns and that the 11-month operation studied yielded a lower-bound revenue between $1,300,620 and $1,352,266. We conclude that sextortion spamming is a lucrative business and spammers will likely continue to send bulk emails that try to extort money through cryptocurrencies.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Paquet-Clouston et al. (2019) found that spammers amassed earnings between $1,300,620 and $1,352,266 (USD) in Bitcoin over an 11-month period, averaging a monthly revenue of $122,933 (USD).
“their examination of sextortion spam campaigns and their financial outcomes revealed that spammers amassed earnings between $1,300,620 and $1,352,266 (USD) in Bitcoin over an 11-month period, averaging a monthly revenue of $122,933 (USD).”
From Sextortion: A Scoping Review (2025) · cites this paper as Paquet-Clouston et al., 2019
Cites
(2011) · IEEE Software · doi:10.1109/ms.2011.67 · Cited by 2,038 · see citing works
Meiklejohn, S., Pomarole, M., Jordan, G., Levchenko, K., McCoy, D., Voelker, G. M., & Savage, S. (2013) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2504730.2504747 · Cited by 1,023 · see citing works
Quantitative Analysis of the Full Bitcoin Transaction Graph
Ron, D., & Shamir, A. (2013) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-39884-1_2 · Cited by 1,019 · see citing works
An Analysis of Anonymity in the Bitcoin System
Reid, F., & Harrigan, M. (2012) · Springer eBooks · doi:10.1007/978-1-4614-4139-7_10 · Cited by 786 · see citing works
An Analysis of Anonymity in the Bitcoin System
Reid, F., & Harrigan, M. (2011) · doi:10.1109/passat/socialcom.2011.79 · Cited by 581 · see citing works
Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G. M., Paxson, V., & Savage, S. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455774 · Cited by 323 · see citing works
BitIodine: Extracting Intelligence from the Bitcoin Network
Spagnuolo, M., Maggi, F., & Zanero, S. (2014) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-45472-5_29 · Cited by 307 · see citing works
Detection of review spam: A survey
Heydari, A., Tavakoli, M. A., Salim, N. B., & Heydari, Z. (2014) · Expert Systems with Applications · doi:10.1016/j.eswa.2014.12.029 · Cited by 301 · see citing works
Aleksander Berentsen Recommends “Bitcoin: A Peer-to-Peer Electronic Cash System” by Satoshi Nakamoto
Berentsen, A. (2019) · Springer eBooks · doi:10.1007/978-3-030-17740-9_3 · Cited by 260 · see citing works
Click Trajectories: End-to-End Analysis of the Spam Value Chain
Levchenko, K., Pitsillidis, A., Chachra, N., Enright, B., Félegyházi, M., Grier, C., Halvorson, T., Kanich, C., Kreibich, C., Liu, H., et al. (2011) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2011.24 · Cited by 254 · see citing works
Ransomware payments in the Bitcoin ecosystem
Paquet-Clouston, M., Haslhofer, B., & Dupont, B. (2019) · Journal of Cybersecurity · doi:10.1093/cybsec/tyz003 · Cited by 240 · see citing works
Self-citationZimmerman, D. W., & Zumbo, B. D. (1993) · Canadian Journal of Experimental Psychology/Revue canadienne de psychologie expérimentale · doi:10.1037/h0078850 · Cited by 203 · see citing works
Tracking Ransomware End-to-end
Huang, D. Y., Aliapoulios, M., Li, V. G., Invernizzi, L., Bursztein, E., McRoberts, K., Levin, J., Levchenko, K., Snoeren, A. C., & McCoy, D. (2018) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2018.00047 · Cited by 200 · see citing works
BlockSci: Design and applications of a blockchain analysis platformPreprint
Kalodner, H., Goldfeder, S., Chator, A., Möser, M., & Narayanan, A. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1709.02489 · Cited by 164 · see citing works
The Unreasonable Effectiveness of Address Clustering
Harrigan, M., & Fretter, C. (2016) · IEEE Smart World Congress and International Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People (SmartWorld/UIC/ATC/ScalCom/CBDCom/IoP) · doi:10.1109/uic-atc-scalcom-cbdcom-iop-smartworld.2016.0071 · Cited by 153 · see citing works
Stone-Gross, B., Holz, T., Stringhini, G., & Vigna, G. (2011) · Cited by 152 · see citing works
6 million spam tweets: A large ground truth for timely Twitter spam detection
Chen, C., Zhang, J., Chen, X., Xiang, Y., & Zhou, W. (2015) · International Conference on Communications · doi:10.1109/icc.2015.7249453 · Cited by 135 · see citing works
Rao, J. M., & Reiley, D. (2012) · The Journal of Economic Perspectives · doi:10.1257/jep.26.3.87 · Cited by 126 · see citing works
SoK: Everyone Hates Robocalls: A Survey of Techniques Against Telephone Spam
Tu, H., Doupe, A., Zhao, Z., & Ahn, G.-J. (2016) · 2016 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2016.27 · Cited by 89 · see citing works
Sedhai, S., & Sun, A. (2015) · International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR) · doi:10.1145/2766462.2767701 · Cited by 81 · see citing works
Identifying Bitcoin users by transaction behavior
Monaco, J. V. (2015) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.2177039 · Cited by 57 · see citing works
The harvester, the botmaster, and the spammer
Stringhini, G., Hohlfeld, O., Kruegel, C., & Vigna, G. (2014) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/2590296.2590302 · Cited by 30 · see citing works
Evolution of the Bitcoin Address Graph
Filtz, E., Polleres, A., Karl, R., & Haslhofer, B. (2017) · Springer eBooks · doi:10.1007/978-3-658-19287-7_11 · Cited by 23 · see citing works
Self-citationEconomic Analysis of RansomwarePreprint
Hernandez-Castro, J. C., Cartwright, E. J., & Stepanova, A. (2017) · SSRN Electronic Journal · doi:10.2139/ssrn.2937641 · Cited by 10 · see citing works
Flagged first, then by citations
3 of the 27 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Cryptocurrency Scams: Analysis and Perspectives
Bartoletti, M., Lande, S., Loddo, A., Pompianu, L., & Serusi, S. (2021) · IEEE Access · doi:10.1109/access.2021.3123894 · Cited by 111 · see citing works
Knowledge Discovery in Cryptocurrency Transactions: A Survey
Liu, X. F., Jiang, X.-J., Liu, S.-H., & Tse, C. K. (2021) · IEEE Access · doi:10.1109/access.2021.3062652 · Cited by 97 · see citing works
Supervised learning model for identifying illegal activities in Bitcoin
Nerurkar, P., Bhirud, S. G., Patel, D., Ludinard, R., Busnel, Y., & Kumari, S. (2020) · Applied Intelligence · doi:10.1007/s10489-020-02048-w · Cited by 76 · see citing works
A survey on security challenges and solutions in the IOTA
Conti, M., Kumar, G., Nerurkar, P., Saha, R., & Vigneri, L. (2022) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2022.103383 · Cited by 76 · see citing works
Ray, A., & Henry, N. (2025) · Trauma, Violence, & Abuse · doi:10.1177/15248380241277271 · Cited by 76 · see citing works
“In their study, Paquet-Clouston et al. (2019) highlighted the evolving tactics of spammers, such as using bulk emails and demanding cryptocurrency like Bitcoin.”
Tracing Cryptocurrency Scams: Clustering Replicated Advance-Fee and Phishing Websites
Phillips, R. C., & Wilder, H. (2020) · IEEE International Conference on Blockchain and Cryptocurrency (ICBC) · doi:10.1109/icbc48266.2020.9169433 · Cited by 62 · see citing works
Don’t Fish in Troubled Waters! Characterizing Coronavirus-themed Cryptocurrency Scams
Xia, P., Wang, H., Luo, X., Wu, L., Zhou, Y., Bai, G., Xu, G., Huang, G., & Liu, X. (2020) · APWG Symposium on Electronic Crime Research (eCrime) · doi:10.1109/ecrime51433.2020.9493255 · Cited by 51 · see citing works
Tracking Counterfeit Cryptocurrency End-to-end
Gao, B., Wang, H., Xia, P., Wu, S., Zhou, Y., Luo, X., & Gareth Tyson, A. (2020) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3428335 · Cited by 38 · see citing works
BABD: A Bitcoin Address Behavior Dataset for Pattern Analysis
Xiang, Y., Lei, Y., Ding, B. F., Li, T., Yang, Q., Liu, W., Ren, W., & Choo, K. R. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3347894 · Cited by 32 · see citing works
Illegal activity detection on bitcoin transaction using deep learning
Nerurkar, P. (2023) · Soft Computing · doi:10.1007/s00500-022-07779-1 · Cited by 29 · see citing works
From payday to payoff: Exploring the money laundering strategies of cybercriminals
Nazzari, M. (2023) · Trends in Organized Crime · doi:10.1007/s12117-023-09505-1 · Cited by 22 · see citing works
Mapping the DeFi crime landscape: an evidence-based picture
Carpentier-Desjardins, C., Paquet-Clouston, M., Kitzler, S., & Haslhofer, B. (2024) · Journal of Cybersecurity · doi:10.1093/cybsec/tyae029 · Cited by 24 · see citing works
Self-citationGómez, G., Moreno-Sánchez, P., & Caballero, J. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560587 · Cited by 19 · see citing works
On the motivations and challenges of affiliates involved in cybercrime
Paquet-Clouston, M., & García, S. (2022) · Trends in Organized Crime · doi:10.1007/s12117-022-09474-x · Cited by 19 · see citing works
Self-citationGraphSense: A General-Purpose Cryptoasset Analytics PlatformPreprint
Haslhofer, B., Stütz, R., Romiti, M., & King, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.13613 · Cited by 17 · see citing works
Self-citationAn ego network analysis of sextortionists
Oggier, F., Datta, A., & Phetsouvanh, S. (2020) · Social Network Analysis and Mining · doi:10.1007/s13278-020-00650-x · Cited by 16 · see citing works
RETRACTED ARTICLE: Big data analytics to identify illegal activities on Bitcoin Blockchain for IoMT
Kumar, A., Abhishek, K., Nerurkar, P., Khosravi, M. R., Ghalib, M. R., & Shankar, A. (2021) · Personal and Ubiquitous Computing · doi:10.1007/s00779-021-01562-z · Cited by 15 · see citing works
RetractedLost in the Maze: Disentangling the Behavioral Variety of Money Laundering
Nazzari, M. (2023) · European Journal on Criminal Policy and Research · doi:10.1007/s10610-023-09572-8 · Cited by 14 · see citing works
How do Ivorian Cyberfraudsters Manage Their Criminal Proceeds?
Cretu-Adatte, C., Zbinden, R., Brunoni, L., Bunning, H., Azi, J. W., & Beaudet-Labrecque, O. (2024) · European Journal on Criminal Policy and Research · doi:10.1007/s10610-024-09597-7 · Cited by 12 · see citing works
CLTracer: A Cross-Ledger Tracing framework based on address relationships
Zhang, Z., Yin, J., Hu, B., Gao, T., Li, W., Wu, Q., & Liu, J. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102558 · Cited by 12 · see citing works
Towards Understanding and Characterizing the Arbitrage Bot Scam In the Wild
Li, K., Guan, S., & Lee, D. (2023) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3626783 · Cited by 12 · see citing works
Bitcoin research with a transaction graph dataset
Schnoering, H., & Vazirgiannis, M. (2025) · Scientific Data · doi:10.1038/s41597-025-04684-8 · Cited by 12 · see citing works
Online sextortion: Characteristics of offences from a decade of community reporting
Edwards, M., & Hollely, N. M. (2023) · Journal of Economic Criminology · doi:10.1016/j.jeconc.2023.100038 · Cited by 11 · see citing works
Norta, A., Udokwu, C. J., Voicu-Dorobanţu, R., Ogunyemi, A. A., Sturua, N., & Craß, S. (2025) · Future Internet · doi:10.3390/fi17070309 · Cited by 16 · see citing works
Cybercrime Specialization: An Exposé of a Malicious Android Obfuscation-as-a-Service
Sembera, V., Paquet-Clouston, M., García, S., & Erquiaga, M. J. (2021) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw54576.2021.00029 · Cited by 11 · see citing works
Self-citationCybercrime Bitcoin Revenue Estimations: Quantifying the Impact of Methodology and Coverage
Gómez, G., van Liebergen, K., & Caballero, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623094 · Cited by 10 · see citing works
Forsage: Anatomy of a Smart-Contract Pyramid Scheme
Kell, T., Yousaf, H., Allen, S., Meiklejohn, S., & Juels, A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-47751-5_14 · Cited by 10 · see citing works
Tracking Counterfeit Cryptocurrency End-to-end
Gao, B., Wang, H., Xia, P., Wu, S., Zhou, Y., Luo, X., & Gareth Tyson, A. (2021) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/3410220.3456282 · Cited by 8 · see citing works
Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates
Liu, E., Kappos, G., Mugnier, E., Invernizzi, L., Savage, S., Tao, D. D. J., Thomas, K., Voelker, G. M., & Meiklejohn, S. (2024) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3646547.3689005 · Cited by 6 · see citing works
A Large-Scale Bitcoin Abuse Measurement and Clustering Analysis Utilizing Public Reports
Choi, J., Jaehan, K. I. M., Song, M., Hanna, K. I. M., Nahyeon, P. A. R. K., Seo, M.-J., Youngjin, J. I. N., & Shin, S. (2022) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2021edp7182 · Cited by 5 · see citing works
Examining Financial Trails of Online Frauds and Money Laundering Choices of Cybercriminals
Bekkers, L., Snaphaan, T., & Leukfeldt, R. (2026) · European Journal on Criminal Policy and Research · doi:10.1007/s10610-026-09663-2 · Cited by 4 · see citing works
Noval, S. M. R. (2023) · Russian Law Journal · doi:10.52783/rlj.v11i5s.891 · Cited by 4 · see citing works
All Your LLMs Belong to Us: Experiments with a New Extortion Phishing Dataset
Qachfar, F. Z., & Verma, R. M. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-65172-4_15 · Cited by 4 · see citing works
On the Dark Side of the Coin: Characterizing Bitcoin Use for Illicit Activities
Rosenquist, H., Hasselquist, D., Arlitt, M. F., & Carlsson, N. F. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-56252-5_3 · Cited by 4 · see citing works
Choi, J., Taehwa, L. E. E., Kim, K., Seo, M.-J., Cui, J., & Shin, S. (2022) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2021edl8092 · Cited by 3 · see citing works
Exploring Unconfirmed Transactions for Effective Bitcoin Address Clustering
Wang, K., Cheng, Y., Tong, M. W., Niu, Z., Pang, J., & Han, W. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645684 · Cited by 3 · see citing works
Tracking Counterfeit Cryptocurrency End-to-end
Gao, B., Wang, H., Xia, P., Wu, S., Zhou, Y., Luo, X., & Gareth Tyson, A. (2021) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/3543516.3456282 · Cited by 2 · see citing works
Increasing the Efficiency of Cryptoasset Investigations by Connecting the Cases
Haslhofer, B., Hanslbauer, C., Fröwis, M., & Goger, T. (2023) · APWG Symposium on Electronic Crime Research (eCrime) · doi:10.1109/ecrime61234.2023.10485550 · Cited by 2 · see citing works
Self-citationDetection of Spam Transactions in Blockchain by Graph Analysis
Kouame, R. M., Saito, K., & Inaba, H. (2022) · IEEE Global Conference on Consumer Electronics (GCCE) · doi:10.1109/gcce56475.2022.10014194 · Cited by 2 · see citing works
CyberDART: A Corporate Federation System for Mitigating Email Threats
Stryczek, S., Gwiazdowicz, M., Gozdecki, J., Kosek‐Szott, K., Rapacz, N., Rza̧sa, J., Szott, S., & Natkaniec, M. (2024) · IEEE Access · doi:10.1109/access.2024.3516657 · Cited by 1 · see citing works
Offchain Runtime Verification (for The Tezos Blockchain)
Capretto, M., Ceresa, M., Gorostiaga, F., Macías, F., Pedregal, P., & Sánchez, C. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-82349-7_17 · Cited by 1 · see citing works
Bitcoin Flows from Sanctioned Sources
Flodmark, A., Samuelson, R., Hasselquist, D., Arlitt, M. F., & Carlsson, N. F. (2025) · Conference on Local Computer Networks · doi:10.1109/lcn65610.2025.11146304 · Cited by 1 · see citing works
Two-step email spam detection: comparing machine and deep learning accuracy
Salhi, D. E., Rawashdeh, M., Bdair, T. M., & Zamil, M. G. H. A. (2025) · Electrotehnica Electronica Automatica · doi:10.46904/eea.25.73.2.1108011 · Cited by 1 · see citing works
Ingemarsson, L., Karlsson, K. D., & Carlsson, N. F. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726488 · Cited by 1 · see citing works
Linking Cryptoasset Attribution Tags to Knowledge Graph Entities: An LLM-Based Approach
Avice, R., Haslhofer, B., Li, Z., & Zhou, J. J. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-07035-7_22 · Cited by 1 · see citing works
Self-citationInternational Law, Technology, and Gender-Based Violence
Rigotti, C. (2024) · Oxford Research Encyclopedia of International Studies · doi:10.1093/acrefore/9780190846626.013.822 · Cited by 1 · see citing works
CAAW’22: 2022 International Workshop on Cryptoasset Analytics
Victor, F., Haslhofer, B., Gupta, S. S., Möser, M., & Böhme, R. (2022) · International World Wide Web Conference (WWW) · doi:10.1145/3487553.3524882
Self-citationCAAW’23: The 2nd International Cryptoasset Analytics Workshop
Haslhofer, B., Victor, F., Strohmaier, M., & Xu, J. (2023) · International World Wide Web Conference (WWW) · doi:10.1145/3543873.3589748
Self-citationReal-CATS: A Practical Training Ground for Emerging Research on Cryptocurrency Cybercrime Detection
Shi, J., Duan, C., Lei, H., & Wang, L. (2026) · International Conference on Networking and Network Applications (NaNA) · doi:10.23919/nanacps00070.2026.00020
Yong, Z., Ding, B. F., Xiong, R., Ren, W., Wu, C., Li, H., Sun, H., & Chen, S. (2025) · Blockchain Research and Applications · doi:10.1016/j.bcra.2025.100415
Unicorns in the Wild West: Empirical Analysis of Cybercrime Facilitated by Cryptocurrencies
Mukherjee, A., & Moore, T. (2025) · APWG Symposium on Electronic Crime Research (eCrime) · doi:10.1109/ecrime66972.2025.11327757
- Authors
- Paquet-Clouston, M., Romiti, M., Haslhofer, B., & Charvat, T.
- Affiliations
- GoSecure
- AIT Austrian Institute of Technology GmbH (AT)
- Excello
- Venue
- Proceedings of the 1st ACM Conference on Advances in Financial Technologies
- Publisher
- ACM
- Published
- 2019-10-21
- Pages
- 76-88
- OpenAlex
- W2981756928
- Cited by
- 51
- References
- 27
- Citations by year
- 2026: 3 · 2025: 7 · 2024: 10 · 2023: 11 · 2022: 7 · 2021: 8 · 2020: 5
- FWCI
- 3.98
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM Conference on Advances in Financial Technologies (AFT) (publishedVersion)
- Funders
- European Union Horizon 2020 research and innovation programme (TITANIUM (No. 740558))
- Austrian FFG?s KIRAS programme (VIRTCRIME (No. 860672))
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Keywords
- sextortion, spam, cryptocurrency, Bitcoin, Bitcoin addresses, transaction graphs, blockchain analysis, pricing strategy, revenue forecasting
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review