Technical Summary: The Kosmosis Approach to Crypto Rug Pull Detection

Problem Statement

Crypto rug pulls have emerged as a critical threat to the integrity of blockchain ecosystems, resulting in significant financial losses and eroding investor trust. While existing detection methods rely heavily on transaction graph analysis within blockchain networks, they face two fundamental limitations:

1. Pseudonymity: Current approaches are constrained to blockchain data, making it difficult to link pseudonymous addresses to real-world entities.
2. Lack of Semantics: Traditional graph analysis focuses on what assets were transferred, where, and how much, but fails to capture the why and how of transaction semantics (e.g., the specific intent or function executed within a smart contract).

Consequently, preventive methods based solely on transaction patterns are inherently limited in their ability to detect sophisticated fraud schemes or provide early warnings to users.

Methodology: The Kosmosis Approach

To address these limitations, the authors propose Kosmosis, an approach designed to incrementally construct a Knowledge Graph (KG) by fusing heterogeneous data sources. The methodology is structured around a multi-stage pipeline comprising data ingestion, processing, and storage.

1. Incremental Knowledge Graph Construction

The Kosmosis pipeline integrates data from three primary sources:

• Blockchain Data: Specifically Ethereum, ingested continuously via WebSocket connections.
• Social Media Data: Unstructured text from the X (formerly Twitter) Filtered Stream API, ingested incrementally.
• Enrichment Data: Structured data from external knowledge bases (e.g., Golden Knowledge Graph) and expert attributions.

The system utilizes the EthOn ontology to formalize concepts and relations within the Ethereum domain, storing the resulting data in a triplestore (RDF format) to facilitate semantic querying.

2. Data Processing Workflows

The pipeline employs specialized workflows for different data types:

• Blockchain Data Processing:

  • Address Relation Extraction: This module decodes transaction input data using the Application Binary Interface (ABI) of interacting smart contracts. It involves disassembling bytecode to identify opcodes (e.g., SSTORE, CREATE) and reconstructing the ABI if not publicly available. This allows the system to tag transactions with semantic meanings (e.g., distinguishing a "mint" function from a generic transfer).
  • Address Tagging: Based on extracted relations, addresses are tagged (e.g., "deployer," "NFT minter").
  • Entity Resolution: Blockchain addresses are resolved to entities in the KG. The system employs "blocking" to narrow the search scope and uses heuristics like deposit address reuse (proposed by Victor) to cluster addresses controlled by the same entity.

• Text Processing:

  • Named Entity Recognition (NER): Identifies entities (persons, organizations) in social media text.
  • Relation Extraction: Determines relationships between entities (e.g., "Alice works for Acme").
  • Entity Resolution: Matches new entities against existing KG entities using blocking and pairwise similarity assessment to link social media identities to blockchain addresses.

• Enrichment Processing:

  • Integrates external data (e.g., team member details from the Golden Knowledge Graph) to map blockchain addresses to real-world identities, triggered by events such as new entity additions.

3. Semantic Querying and Detection

The constructed KG enables the use of SPARQL queries to detect fraudulent patterns. The system aggregates transactions (e.g., summing ETH transfers between EOAs) and annotates edges with semantic labels (e.g., mintMonkey, Deploy). This allows for the identification of suspicious patterns, such as rapid bulk transfers of funds to a deployer's address immediately following token minting events, which deviates from legitimate project behavior.

Key Contributions

• Semantic Extraction: The paper introduces a method to extract the semantics of blockchain transactions by decoding smart contract input data, moving beyond simple asset transfer tracking to understanding transaction intent.
• Cross-Modal Fusion: Kosmosis bridges the gap between pseudonymous blockchain addresses and real-world entities by fusing on-chain data with off-chain social media and enrichment data.
• Incremental Pipeline: The authors propose a scalable architecture capable of handling continuous, incremental, periodic, and event-driven data ingestion without requiring full KG reconstruction.
• Preventive Alerting Framework: The approach shifts the paradigm from post-hoc analysis to preventive detection, aiming to alert users before they interact with fraudulent projects.

Results and Case Study

The paper validates the Kosmosis approach through a case study involving a real-world fraudster known as "Homer_eth," who executed five NFT rug pulls in 2021, accumulating over $2.8 million.

• Baseline Visualization: A standard transaction graph (Figure 4) shows fund flows but lacks context regarding the identity of the actors or the specific nature of the transactions.
• Kosmosis Enhancement: The constructed KG (Figure 5) semantically annotates edges (e.g., linking "mint" functions to specific contracts) and connects the deployer address (0xc8a6) to the social media identity "Homer_eth" via X posts.
• Detection Logic: The system demonstrates that by analyzing the semantic flow, it can identify that mint proceeds were diverted directly to the deployer's address rather than a project treasury. In a hypothetical "Future User Story," the system would have flagged this anomaly to a user ("Bob") before transaction confirmation, warning of the risk based on the pattern of fund diversion and the linked social identity.

Significance and Claims

The authors claim that Kosmosis represents a significant advancement in crypto fraud detection by:

1. Enhancing Detection Depth: It identifies fraud patterns invisible to traditional transaction graph analysis by incorporating transaction semantics.
2. Bridging the Identity Gap: It connects pseudonymous transactions to real-world entities through social media correlation, enabling more effective attribution.
3. Enabling Prevention: By providing a semantic foundation for reasoning, the approach supports the development of real-time alerting systems that can warn users of potential rug pulls before funds are lost.

The paper acknowledges current limitations, including the reliance on explicit links between social media posts and blockchain addresses, the need for more sophisticated entity resolution without direct references, and the current restriction to account-based blockchains like Ethereum. Future work aims to generalize the classification method, refine data ingestion filters, and expand support to other blockchain architectures like Bitcoin.