{"id":"https://openalex.org/W2963604227","doi":"https://doi.org/10.1093/cybsec/tyz003","title":"Ransomware payments in the Bitcoin ecosystem","display_name":"Ransomware payments in the Bitcoin ecosystem","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W2963604227","doi":"https://doi.org/10.1093/cybsec/tyz003","mag":"2963604227"},"language":"en","primary_location":{"id":"doi:10.1093/cybsec/tyz003","is_oa":true,"landing_page_url":"https://doi.org/10.1093/cybsec/tyz003","pdf_url":"https://academic.oup.com/cybersecurity/article-pdf/5/1/tyz003/28638629/tyz003.pdf","source":{"id":"https://openalex.org/S2735156331","display_name":"Journal of Cybersecurity","issn_l":"2057-2085","issn":["2057-2085","2057-2093"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://academic.oup.com/cybersecurity/article-pdf/5/1/tyz003/28638629/tyz003.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5012748638","display_name":"Masarah Paquet-Clouston","orcid":"https://orcid.org/0000-0001-8275-8445"},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Masarah Paquet-Clouston","raw_affiliation_strings":["GoSecure, 630 Ren\u00e9-L\u00e9vesque Blvd W #2630, Montreal, QC H3B 1S6, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"GoSecure, 630 Ren\u00e9-L\u00e9vesque Blvd W #2630, Montreal, QC H3B 1S6, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078932059","display_name":"Bernhard Haslhofer","orcid":"https://orcid.org/0000-0002-0415-4491"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Bernhard Haslhofer","raw_affiliation_strings":["AIT Austrian Institute of Technology, Giefinggasse 4, 1210 Vienna, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology, Giefinggasse 4, 1210 Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076289195","display_name":"Beno\u00eet Dupont","orcid":"https://orcid.org/0000-0001-9909-8594"},"institutions":[{"id":"https://openalex.org/I70931966","display_name":"Universit\u00e9 de Montr\u00e9al","ror":"https://ror.org/0161xgx34","country_code":"CA","type":"education","lineage":["https://openalex.org/I70931966"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Beno\u00eet Dupont","raw_affiliation_strings":["Universit\u00e9 de Montr\u00e9al, 2900 Edouard Montpetit Blvd, Montreal, QC H3T 1J4, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universit\u00e9 de Montr\u00e9al, 2900 Edouard Montpetit Blvd, Montreal, QC H3T 1J4, Canada","institution_ids":["https://openalex.org/I70931966"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5012748638"],"corresponding_institution_ids":[],"apc_list":{"value":1864,"currency":"USD","value_usd":1864},"apc_paid":{"value":1864,"currency":"USD","value_usd":1864},"fwci":19.0402,"has_fulltext":true,"cited_by_count":237,"citation_normalized_percentile":{"value":0.9958943,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":"5","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9937999844551086,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.9377278685569763},{"id":"https://openalex.org/keywords/payment","display_name":"Payment","score":0.7121062874794006},{"id":"https://openalex.org/keywords/cybercrime","display_name":"Cybercrime","score":0.6743835210800171},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.5970141887664795},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.552821695804596},{"id":"https://openalex.org/keywords/law-enforcement","display_name":"Law enforcement","score":0.5277025699615479},{"id":"https://openalex.org/keywords/ransom","display_name":"Ransom","score":0.5017280578613281},{"id":"https://openalex.org/keywords/enforcement","display_name":"Enforcement","score":0.4902384877204895},{"id":"https://openalex.org/keywords/virtual-currency","display_name":"Virtual currency","score":0.47671809792518616},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4742029011249542},{"id":"https://openalex.org/keywords/cryptocurrency","display_name":"Cryptocurrency","score":0.47281327843666077},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.42564254999160767},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2884187698364258},{"id":"https://openalex.org/keywords/finance","display_name":"Finance","score":0.2420181930065155},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.24008020758628845},{"id":"https://openalex.org/keywords/economics","display_name":"Economics","score":0.19684699177742004},{"id":"https://openalex.org/keywords/monetary-economics","display_name":"Monetary economics","score":0.16037169098854065},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.13515067100524902},{"id":"https://openalex.org/keywords/currency","display_name":"Currency","score":0.11706092953681946}],"concepts":[{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.9377278685569763},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.7121062874794006},{"id":"https://openalex.org/C2779390178","wikidata":"https://www.wikidata.org/wiki/Q29137","display_name":"Cybercrime","level":3,"score":0.6743835210800171},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.5970141887664795},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.552821695804596},{"id":"https://openalex.org/C2780262971","wikidata":"https://www.wikidata.org/wiki/Q44554","display_name":"Law enforcement","level":2,"score":0.5277025699615479},{"id":"https://openalex.org/C2781426709","wikidata":"https://www.wikidata.org/wiki/Q1414572","display_name":"Ransom","level":2,"score":0.5017280578613281},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.4902384877204895},{"id":"https://openalex.org/C47487560","wikidata":"https://www.wikidata.org/wiki/Q4112083","display_name":"Virtual currency","level":3,"score":0.47671809792518616},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4742029011249542},{"id":"https://openalex.org/C180706569","wikidata":"https://www.wikidata.org/wiki/Q13479982","display_name":"Cryptocurrency","level":2,"score":0.47281327843666077},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.42564254999160767},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2884187698364258},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.2420181930065155},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.24008020758628845},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.19684699177742004},{"id":"https://openalex.org/C556758197","wikidata":"https://www.wikidata.org/wiki/Q580018","display_name":"Monetary economics","level":1,"score":0.16037169098854065},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.13515067100524902},{"id":"https://openalex.org/C141121606","wikidata":"https://www.wikidata.org/wiki/Q8142","display_name":"Currency","level":2,"score":0.11706092953681946},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1093/cybsec/tyz003","is_oa":true,"landing_page_url":"https://doi.org/10.1093/cybsec/tyz003","pdf_url":"https://academic.oup.com/cybersecurity/article-pdf/5/1/tyz003/28638629/tyz003.pdf","source":{"id":"https://openalex.org/S2735156331","display_name":"Journal of Cybersecurity","issn_l":"2057-2085","issn":["2057-2085","2057-2093"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1093/cybsec/tyz003","is_oa":true,"landing_page_url":"https://doi.org/10.1093/cybsec/tyz003","pdf_url":"https://academic.oup.com/cybersecurity/article-pdf/5/1/tyz003/28638629/tyz003.pdf","source":{"id":"https://openalex.org/S2735156331","display_name":"Journal of Cybersecurity","issn_l":"2057-2085","issn":["2057-2085","2057-2093"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6100000143051147,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G8936679960","display_name":"Tools for the Investigation of Transactions in Underground Markets","funder_award_id":"740558","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2963604227.pdf","grobid_xml":"https://content.openalex.org/works/W2963604227.grobid-xml"},"referenced_works_count":26,"referenced_works":["https://openalex.org/W582365371","https://openalex.org/W1454642304","https://openalex.org/W1695856642","https://openalex.org/W1988699025","https://openalex.org/W2022932831","https://openalex.org/W2119359024","https://openalex.org/W2140564944","https://openalex.org/W2141985040","https://openalex.org/W2209453414","https://openalex.org/W2223594212","https://openalex.org/W2350778671","https://openalex.org/W2367504390","https://openalex.org/W2468345220","https://openalex.org/W2489255716","https://openalex.org/W2508622220","https://openalex.org/W2513529237","https://openalex.org/W2514361410","https://openalex.org/W2559964890","https://openalex.org/W2601591992","https://openalex.org/W3101595491","https://openalex.org/W4230829580","https://openalex.org/W4239628477","https://openalex.org/W4252403475","https://openalex.org/W4300072878","https://openalex.org/W6616968592","https://openalex.org/W6708128796"],"related_works":["https://openalex.org/W4237045072","https://openalex.org/W4386388924","https://openalex.org/W3095609254","https://openalex.org/W2805263553","https://openalex.org/W2614042168","https://openalex.org/W2778994855","https://openalex.org/W4398199982","https://openalex.org/W2913313394","https://openalex.org/W4317182290","https://openalex.org/W2989970626"],"abstract_inverted_index":{"Ransomware":[0],"can":[1,184],"prevent":[2],"a":[3,7,13,48,70,140,162],"user":[4],"from":[5,130],"accessing":[6],"device":[8],"and":[9,44,75,103,127,180,197],"its":[10],"files":[11],"until":[12],"ransom":[14],"is":[15,62,157],"paid":[16],"to":[17,82,106,111,132,189,204],"the":[18,35,45,54,90,99,117,134,155,169,172,186,191,194,206],"attacker,":[19],"most":[20],"frequently":[21],"in":[22],"Bitcoin.":[23],"With":[24],"over":[25],"500":[26],"known":[27],"ransomware":[28,60,113,125,137],"families,":[29],"it":[30,105],"has":[31,139],"become":[32],"one":[33],"of":[34,59,123,143,165,171,193],"dominant":[36],"cybercrime":[37],"threats":[38],"for":[39,73,136,168],"law":[40,181],"enforcement,":[41],"security":[42],"professionals,":[43],"public.":[46],"However,":[47],"more":[49],"comprehensive,":[50],"evidence-based":[51],"picture":[52],"on":[53,78,86,89,175,201],"global":[55],"direct":[56,120],"financial":[57,121],"impact":[58,122],"attacks":[61],"still":[63],"missing.":[64],"In":[65],"this":[66,96],"article,":[67],"we":[68],"present":[69],"data-driven":[71],"method":[72,97],"identifying":[74],"gathering":[76],"information":[77],"Bitcoin":[79,92],"transactions":[80,109],"related":[81,110],"illicit":[83,195],"activity":[84],"based":[85],"footprints":[87],"left":[88],"public":[91],"blockchain.":[93],"We":[94,115,151],"implement":[95],"on-top-of":[98],"GraphSense":[100],"open-source":[101],"platform":[102],"apply":[104],"empirically":[107],"analyze":[108],"35":[112],"families.":[114],"estimate":[116],"lower":[118],"bound":[119],"each":[124],"family":[126],"find":[128,153],"that,":[129],"2013":[131],"mid-2017,":[133],"market":[135,156,196],"payments":[138],"minimum":[141],"worth":[142],"USD":[144],"12":[145],"768":[146],"536":[147],"(22":[148],"967.54":[149],"BTC).":[150],"also":[152],"that":[154],"highly":[158],"skewed":[159],"with":[160],"only":[161],"few":[163],"number":[164],"players":[166],"responsible":[167],"majority":[170],"payments.":[173],"Based":[174],"these":[176],"research":[177],"findings,":[178],"policy-makers":[179],"enforcement":[182],"agencies":[183],"use":[185],"statistics":[187],"provided":[188],"understand":[190],"size":[192],"make":[198],"informed":[199],"decisions":[200],"how":[202],"best":[203],"address":[205],"threat.":[207]},"counts_by_year":[{"year":2026,"cited_by_count":19},{"year":2025,"cited_by_count":26},{"year":2024,"cited_by_count":31},{"year":2023,"cited_by_count":38},{"year":2022,"cited_by_count":35},{"year":2021,"cited_by_count":48},{"year":2020,"cited_by_count":25},{"year":2019,"cited_by_count":14},{"year":2018,"cited_by_count":1}],"updated_date":"2026-08-08T01:25:22.217667","created_date":"2025-10-10T00:00:00"}