BTCScamFinder: Catching crypto scam sites before the first victim pays and tracing the criminals behind them

Online scams scale globally and cheaply, and cryptocurrencies sit at the centre. In 2024, the FBI's IC3 recorded US9.3 billion in crypto losses alone, up 66% year-on-year. Pig-butchering investment fraud accounted for US5.8 billion of that. On the supply side, scam infrastructure is now sold as a service: phishing-as-a-service providers like LabHost were offering over 170 fake websites for US$249 a month before law enforcement shut them down.

The defender side of this equation is broken. Criminals deploy scam sites in minutes. Law enforcement can take weeks to respond. The tools that exist only solve one piece of the problem. Website scanners flag suspicious pages but never trace the money. Blockchain analysis tools trace funds but need someone to hand them a reliable starting address. Abuse feeds offer leads but are noisy, inconsistently labelled, and nearly impossible to audit. Nothing connects these pieces into a single evidence chain, and investigators lose provenance at every manual handoff.

This talk introduces BTCScamFinder, an open-source forensic pipeline that does not wait for victim reports. It continuously monitors newly registered domains, analyses them using machine learning, rule-based multi-stage scoring, and threat intelligence, and flags suspicious sites within hours of going live. When a site is flagged, the system extracts on-page cryptocurrency addresses, links them to real Bitcoin transactions, traces where the funds move using conservative provenance-aware heuristics, and identifies probable cash-out points. Every detection and every traced link carries a full evidence trail that is reproducible, auditable, and exportable via STIX 2.1 and W3C PROV-DM. The entire pipeline runs on publicly available data and open-source intelligence.

BTCScamFinder is built as 25+ containerised microservices. It is transparent, extensible, and designed so teams can adapt it. The interface is purpose-built for analysts and SOC operators, with clear visual workflows so investigators can move from alert to evidence without fighting the tooling.

I will walk through a live trace from a flagged scam site through to Bitcoin transactions, show how combining creative detection with conservative blockchain analysis avoids both missed scams and false accusations, and discuss what it takes to build forensic-grade tooling as a single researcher using only public data.

The techniques apply directly to investment fraud, ransomware payments, money laundering, and any scenario where criminals use cryptocurrency to move illicit funds. Whether you work in incident response, law enforcement, financial crime, counter-terrorism financing, or platform trust and safety, this changes how early you can act.