arXiv subjects

Bernhard Haslhofer

Publications and source records attributed to Bernhard Haslhofer.

At least 19 recordsLinked to original sources

arXiv2026

Stablecoins under Stress in a National Economy: Transaction-Level Evidence from Austrian Crypto-Asset Service Providers

Cryptoassets are increasingly entangled with the traditional financial system, and how this activity integrates into national economies and behaves under stress bears on financial stability and the design of public digital money. However, blockchain pseudonymity and the lack of geographic identifiers force existing work to rely on indirect proxies to infer and locate market participants. Here we use a regulatory registry that directly identifies the on-chain addresses of all crypto-asset service providers (CASPs) registered in Austria, reconstructing their on-chain transaction activity across Bitcoin, Ether, USDC, and USDT through May 2025, and separating retail-like from institutionally mediated flows. We find that Austrian CASPs intermediate roughly USD 30 billion with external counterparties and are integrated globally rather than domestically. In value, this activity is dominated by a few institutional counterparties; in number, by retail-like ones. Around three major shocks, the Terra-Luna collapse, the FTX bankruptcy, and the Silicon Valley Bank failure, the two groups respond through different mechanisms, and stablecoins do not act as a uniform safe haven. The clearest case is SVB, where retail-like deposits and institutional withdrawals are consistent with USDC's two-tiered redemption mechanism. These patterns are invisible in aggregate data. Registry-based, transaction-level measurement thus offers a reproducible, cross-jurisdictional basis for monitoring how cryptoasset markets transmit risk.

q-fin.GN↗

arXiv2026

How Reliable Is the Multi-Input Heuristic for Bitcoin Address Clustering in Law Enforcement Contexts?

Address clustering is an important technique in blockchain forensics, widely employed by law enforcement to trace illicit crypto asset flows. The multi-input heuristic (MIH), which clusters addresses potentially associated with the same entity, is the most widely used. Yet, despite its broad adoption, the MIH has rarely been evaluated against reliable ground truth data. We implement a reusable evaluation framework covering nine established metrics and apply it to ground truth address-to-entity mappings obtained directly from European crypto asset service providers under legally mandated reporting obligations. When evaluation is restricted to reported addresses, the MIH appears strong at dataset level: we observe no mergers between reported services and recover same-service address pairs with recall 0.71. However, this result is driven by one large service and ignores unlabeled addresses absorbed into full clusters. Metrics that assess the full clusters show substantially lower precision and recall (0.36 and 0.44), meaning that services are often only partially recovered or embedded in larger clusters. Entity-level results further reveal near-complete failures for some services. When MIH-based clusters are used to support criminal suspicion, preliminary seizure of crypto assets to secure later forfeiture/ confiscation, or as evidence in trial proceedings, prosecutors and judges must account for the heuristic's metric-dependent and entity-dependent reliability.

cs.CR↗

arXiv2026

Tracing Stablecoin Contagion during the USDC Depeg after the Silicon Valley Bank Collapse

The March 2023 collapse of Silicon Valley Bank (SVB) disrupted the core premise of stablecoins, which are digital tokens designed to maintain a fixed value against the U.S. dollar and serve as on-chain substitutes for dollar liquidity. The event triggered a sharp depeg of USDC, creating a rare exogenous shock to the stablecoin ecosystem. While price deviations during this crisis are well documented, the underlying behavioral reorganization of on-chain activity remains less understood. Here, we analyze high-granularity transaction data to measure the shock's effects on network activities, volumes, and prices, reconstructing the contagion pathway from market-wide synchronization down to account-level reallocation. By extracting phase dynamics, we first show that transaction activity across major stablecoins became strongly synchronized during the crisis window, indicating a collective market-level response. We then uncover a bifurcated contagion pathway. While USDT, WBTC, and WETH reacted primarily as liquidity absorption channels with larger trade volumes, only USDC-related assets exhibited immediate price responses alongside surging transaction counts. This reflects the dominant role of USDC-related assets in this incident and their immediate behavioral connection to user panic, driving a mass reallocation from single-coin to multi-coin portfolios. Finally, governed by persistent intraday time-zone rhythms and balance-size heterogeneity, these findings provide a comprehensive empirical framework for understanding systemic risk and flight-to-quality mechanisms in fractional-reserve digital asset networks.

cs.CE↗

arXiv2026

DeFi Yield Aggregators: Analysing Investment Strategies and Structural Dependencies

Yield aggregators are financial services in Decentralised Finance (DeFi) providing automated investment management and return optimisation for users. In this study, we investigate the operational mechanisms and monetary flows of two major yield aggregators, Yearn Finance and Cian, over the period from May 4, 2024 to May 3, 2025. Our supporting conceptual framework decomposes yield aggregator operations into user investment and strategy management cycles. Using a network approach for 2,459 Yearn and 921 Cian transactions, we trace protocol interactions and capital flows across the ecosystem. Users invested 15.7M USD into Yearn's USDC vault, which generated yield through liquidity provision and dynamic allocation across DeFi protocols. Cian, deployed later, attracted 54.0M USD into its staked-ETH (stETH) vault and implemented sophisticated leverage through flashloan-enabled recursive staking. Yearn's USDC vault achieves an annual yield of 5.41%, while Cian's stETH vault produces 4.22% with higher risk exposure. We use the operational insights from our analysis to extend the existing DeFi Stack Reference Model (DSR) with new financial primitives to highlight structural risk dependencies. Overall, our findings show that strategic complexity in yield aggregation does not necessarily translate into higher returns but materially expands risk exposure.

cs.CE↗

arXiv2026

Modern Portfolio Theory in the Crypto-Wilderness

Modern Portfolio Theory (MPT) prescribes how to maximise the return of an asset portfolio for a given level of risk. The optimal trade-off between return and variance defines the efficient frontier. Whether actual cryptoasset portfolios approximate this prescription and whether proximity to the frontier translates into realised performance remain difficult to test at large scale in traditional markets due to their opaque nature and the inaccessibility of data. As we show, public blockchains make these questions measurable: every token transfer is recorded, thus enabling complete portfolio reconstruction for every account at any point in time. We leverage this transparency to reconstruct cryptoasset portfolios for over 116M Ethereum accounts across the full chain history (2015-2025), measure their distance to the constrained efficient frontier, and quantify how deviations translate into realised performance. Here we show that market entry timing, not allocation choice, is the dominant predictor of realised cryptoasset returns. On-chain wealth is highly concentrated and portfolios are pervasively under-diversified, with single-asset holdings accounting for 83.35% of accounts. Two-asset portfolios sit closest to the efficient frontier defined by their held assets, a proximity that reflects the narrowness of their opportunity set rather than deliberate optimisation. Passive market-capitalisation weighting outperforms every MPT optimisation strategy in median realised return, and entry month alone explains 70-79% of the variance in returns, far exceeding the contribution of allocation choice. Mean-variance optimisation therefore appears neither descriptive of observed behaviour nor prescriptively useful in the cryptoasset domain, even if MPT retains its value as a normative benchmark.

cs.CE↗

arXiv2026

Credibility Matters: Motivations, Characteristics, and Influence Mechanisms of Crypto Key Opinion Leaders

Crypto Key Opinion Leaders (KOLs) shape Web3 narratives and retail investment behaviour. In volatile, high-risk markets, their credibility becomes a key determinant of their influence on followers. Yet prior research has focused on lifestyle influencers or generic financial commentary, leaving crypto KOLs' understandings of motivation, credibility, and responsibility underexplored. Drawing on interviews with 13 KOLs and self-determination theory (SDT), we examine how psychological needs are negotiated alongside monetisation and community expectations. Whereas prior work treats finfluencer credibility as a set of static credentials, our findings reveal it to be a self-determined, ethically enacted practice. We identify four community-recognised markers of credibility: self-regulation, bounded epistemic competence, accountability, and reflexive self-correction. This reframes credibility as socio-technical performance, extending SDT into high-risk crypto ecosystems. Methodologically, we employ a hybrid human-LLM thematic analysis. The study surfaces implications for designing credibility signals that prioritise transparency over hype.

cs.SI↗

arXiv2026

Reuse of Public Keys Across UTXO and Account-Based Cryptocurrencies

It is well known that reusing cryptocurrency addresses undermines privacy. This also applies if the same addresses are used in different cryptocurrencies. Nevertheless, cross-chain address reuse appears to be a recurring phenomenon, especially in EVM-based designs. Previous works performed either direct address matching, or basic format conversion, to identify such cases. However, seemingly incompatible address formats e.g., in Bitcoin and Ethereum, can also be derived from the same public keys, since they rely on the same cryptographic primitives. In this paper, we therefore focus on the underlying public keys to discover reuse within, as well as across, different cryptocurrency networks, enabling us to also match incompatible address formats. Specifically, we analyze key reuse across Bitcoin, Ethereum, Litecoin, Dogecoin, Zcash and Tron. Our results reveal that cryptographic keys are extensively and actively reused across these networks, negatively impacting both privacy and security of their users. We are hence the first to expose and quantify cross-chain key reuse between UTXO and account-based cryptocurrencies. Moreover, we devise novel clustering methods across these different cryptocurrency networks that do not rely on heuristics and instead link entities by their knowledge of the underlying secret key.

cs.CR↗

arXiv2025

Slaying the Dragon: The Quest for Democracy in Decentralized Autonomous Organizations (DAOs)

This chapter explores how Decentralized Autonomous Organizations (DAOs), a novel institutional form based on blockchain technology, challenge traditional centralized governance structures. DAOs govern projects ranging from finance to science and digital communities. They aim to redistribute decision-making power through programmable, transparent, and participatory mechanisms. This chapter outlines both the opportunities DAOs present, such as incentive alignment, rapid coordination, and censorship resistance, and the challenges they face, including token concentration, low participation, and the risk of de facto centralization. It further discusses the emerging intersection of DAOs and artificial intelligence, highlighting the potential for increased automation alongside the dangers of diminished human oversight and algorithmic opacity. Ultimately, we discuss under what circumstances DAOs can fulfill their democratic promise or risk replicating the very power asymmetries they seek to overcome.

cs.CY↗

arXiv2025

The Economic Impact of DeFi Crime Events on Decentralized Autonomous Organizations (DAOs)

The Decentralized Finance (DeFi) ecosystem has experienced over \$10 billion in direct losses due to crime events. Beyond these immediate losses, such events often trigger broader market reactions, including price declines, trading activity changes, and reductions in market capitalization. Decentralized Autonomous Organizations (DAOs) govern DeFi applications through tradable governance assets that function like corporate shares for voting and decision-making. Leveraging DeFi's granular trading data, we conduct an event study on 22 crime events between 2020 and 2022 to assess their economic impact on governance asset prices, trading volumes, and market capitalization. Using a dynamic difference-in-differences (DiD) framework with counterfactual governance assets, we aim for causal inference of intraday temporal effects. Our results show that 55% of crime events lead to significant negative price impacts, with an average decline of about 14%. Additionally, 68% of crime events lead to increased governance asset trading volume. Based on these impacts, we estimate indirect economic losses of over $1.3 billion in DAO market capitalization, far exceeding direct victim costs and accounting for 74% of total losses. Our study provides valuable insights into how crime events shape market dynamics and affect DAOs. Moreover, our methodological approach is reproducible and applicable beyond DAOs, offering a framework to assess the indirect economic impact on other cryptoassets.

cs.CE↗

arXiv2025

Towards Verifiability of Total Value Locked (TVL) in Decentralized Finance

Total Value Locked (TVL) aims to measure the aggregate value of cryptoassets deposited in Decentralized Finance (DeFi) protocols. Although blockchain data is public, the way TVL is computed is not well understood. In practice, its calculation on major TVL aggregators relies on self-reports from community members and lacks standardization, making it difficult to verify published figures independently. We thus conduct a systematic study on 939 DeFi projects deployed in Ethereum. We study the methodologies used to compute TVL, examine factors hindering verifiability, and ultimately propose standardization attempts in the field. We find that 10.5% of the protocols rely on external servers; 68 methods alternative to standard balance queries exist, although their use decreased over time; and 240 equal balance queries are repeated on multiple protocols. These findings indicate limits to verifiability and transparency. We thus introduce ``verifiable Total Value Locked'' (vTVL), a metric measuring the TVL that can be verified relying solely on on-chain data and standard balance queries. A case study on 400 protocols shows that our estimations align with published figures for 46.5% of protocols. Informed by these findings, we discuss design guidelines that could facilitate a more verifiable, standardized, and explainable TVL computation.

q-fin.GN↗

arXiv2025

Linking Cryptoasset Attribution Tags to Knowledge Graph Entities: An LLM-based Approach

Attribution tags form the foundation of modern cryptoasset forensics. However, inconsistent or incorrect tags can mislead investigations and even result in false accusations. To address this issue, we propose a novel computational method based on Large Language Models (LLMs) to link attribution tags with well-defined knowledge graph concepts. We implemented this method in an end-to-end pipeline and conducted experiments showing that our approach outperforms baseline methods by up to 37.4% in F1-score across three publicly available attribution tag datasets. By integrating concept filtering and blocking procedures, we generate candidate sets containing five knowledge graph entities, achieving a recall of 93% without the need for labeled data. Additionally, we demonstrate that local LLM models can achieve F1-scores of 90%, comparable to remote models which achieve 94%. We also analyze the cost-performance trade-offs of various LLMs and prompt templates, showing that selecting the most cost-effective configuration can reduce costs by 90%, with only a 1% decrease in performance. Our method not only enhances attribution tag quality but also serves as a blueprint for fostering more reliable forensic evidence.

cs.CR↗

arXiv2024

Assessing the Solvency of Virtual Asset Service Providers: Are Current Standards Sufficient?

Entities like centralized cryptocurrency exchanges fall under the business category of virtual asset service providers (VASPs). As any other enterprise, they can become insolvent. VASPs enable the exchange, custody, and transfer of cryptoassets organized in wallets across distributed ledger technologies (DLTs). Despite the public availability of DLT transactions, the cryptoasset holdings of VASPs are not yet subject to systematic auditing procedures. In this paper, we propose an approach to assess the solvency of a VASP by cross-referencing data from three distinct sources: cryptoasset wallets, balance sheets from the commercial register, and data from supervisory entities. We investigate 24 VASPs registered with the Financial Market Authority in Austria and provide regulatory data insights such as who are the customers and where do they come from. Their yearly incoming and outgoing transaction volume amount to 2 billion EUR for around 1.8 million users. We describe what financial services they provide and find that they are most similar to traditional intermediaries such as brokers, money exchanges, and funds, rather than banks. Next, we empirically measure DLT transaction flows of four VASPs and compare their cryptoasset holdings to balance sheet entries. Data are consistent for two VASPs only. This enables us to identify gaps in the data collection and propose strategies to address them. We remark that any entity in charge of auditing requires proof that a VASP actually controls the funds associated with its on-chain wallets. It is also important to report fiat and cryptoasset and liability positions broken down by asset types at a reasonable frequency.

q-fin.GN↗

arXiv2024

Detecting Financial Bots on the Ethereum Blockchain

The integration of bots in Distributed Ledger Technologies (DLTs) fosters efficiency and automation. However, their use is also associated with predatory trading and market manipulation, and can pose threats to system integrity. It is therefore essential to understand the extent of bot deployment in DLTs; despite this, current detection systems are predominantly rule-based and lack flexibility. In this study, we present a novel approach that utilizes machine learning for the detection of financial bots on the Ethereum platform. First, we systematize existing scientific literature and collect anecdotal evidence to establish a taxonomy for financial bots, comprising 7 categories and 24 subcategories. Next, we create a ground-truth dataset consisting of 133 human and 137 bot addresses. Third, we employ both unsupervised and supervised machine learning algorithms to detect bots deployed on Ethereum. The highest-performing clustering algorithm is a Gaussian Mixture Model with an average cluster purity of 82.6%, while the highest-performing model for binary classification is a Random Forest with an accuracy of 83%. Our machine learning-based detection mechanism contributes to understanding the Ethereum ecosystem dynamics by providing additional insights into the current bot landscape.

cs.CR↗

arXiv2023

Increasing the Efficiency of Cryptoasset Investigations by Connecting the Cases

Law enforcement agencies are confronted with a rapidly growing number of cryptoasset-related cases, often redundantly investigating the same cases without mutual knowledge or shared insights. In this paper, we explore the hypothesis that recognizing and acting upon connections between these cases can significantly streamline investigative processes. Through an analysis of a dataset comprising 34 cyberfraud and 1793 sextortion spam cases, we discovered that 41% of the cyberfraud and 96.9% of the sextortion spam incidents can be interconnected. We introduce a straightforward yet effective tool, which is integrated into a broader cryptoasset forensics workflow and allows investigators to highlight and share case connections. Our research unequivocally demonstrates that recognizing case connections can lead to remarkable efficiencies, especially when extended across crime areas, international borders, and jurisdictions.

cs.CR↗

arXiv2023

Mapping the DeFi crime landscape: an evidence-based picture

Decentralized finance (DeFi) has been the target of numerous profit-driven crimes, but the prevalence and cumulative impact of these crimes have not yet been assessed. This study provides a comprehensive assessment of profit-driven crimes targeting the DeFi sector. We collected data on 1141 crime events from 2017 to 2022. Of these, 1036 were related to DeFi (the main focus of this study) and 105 to centralized finance (CeFi). The findings show that the entire cryptoasset industry has suffered a minimum loss of US$30B, with two-thirds related to CeFi and one-third to DeFi. Focusing on DeFi, a taxonomy was developed to clarify the similarities and differences among these crimes. All events were mapped onto the DeFi stack to assess the impacted technical layers, and the financial damages were quantified to gauge their scale. The results highlight that during an attack, a DeFi actor (an entity developing a DeFi technology) can serve as a direct target (due to technical vulnerabilities or exploitation of human risks), as a perpetrator (through malicious uses of contracts or market manipulations), or as an intermediary (by being imitated through, for example, phishing scams). The findings also show that DeFi actors are the first victims of crimes targeting the DeFi industry: 52% of events targeted them, primarily due to technical vulnerabilities at the protocol layer, and these events accounted for 83% of all financial damages. Alternatively, in 41% of events, DeFi actors were themselves malicious perpetrators, predominantly misusing contracts at the cryptoasset layer (e.g. rug pull scams). However, these events accounted for only 17% of all financial damages. The study offers a preliminary assessment of the size and scope of crime events within the DeFi sector and highlights the vulnerable position of DeFi actors in the ecosystem.

cs.CR↗

arXiv2023

The Governance of Decentralized Autonomous Organizations: A Study of Contributors' Influence, Networks, and Shifts in Voting Power

We present a study analyzing the voting behavior of contributors, or vested users, in Decentralized Autonomous Organizations (DAOs). We evaluate their involvement in decision-making processes, discovering that in at least 7.54% of all DAOs, contributors, on average, held the necessary majority to control governance decisions. Furthermore, contributors have singularly decided at least one proposal in 20.41% of DAOs. Notably, contributors tend to be centrally positioned within the DAO governance ecosystem, suggesting the presence of inner power circles. Additionally, we observed a tendency for shifts in governance token ownership shortly before governance polls take place in 1202 (14.81%) of 8116 evaluated proposals. Our findings highlight the central role of contributors across a spectrum of DAOs, including Decentralized Finance protocols. Our research also offers important empirical insights pertinent to ongoing regulatory activities aimed at increasing transparency to DAO governance frameworks.

cs.SI↗

arXiv2023

Predictability and Comprehensibility in Post-Hoc XAI Methods: A User-Centered Analysis

Post-hoc explainability methods aim to clarify predictions of black-box machine learning models. However, it is still largely unclear how well users comprehend the provided explanations and whether these increase the users ability to predict the model behavior. We approach this question by conducting a user study to evaluate comprehensibility and predictability in two widely used tools: LIME and SHAP. Moreover, we investigate the effect of counterfactual explanations and misclassifications on users ability to understand and predict the model behavior. We find that the comprehensibility of SHAP is significantly reduced when explanations are provided for samples near a model's decision boundary. Furthermore, we find that counterfactual explanations and misclassifications can significantly increase the users understanding of how a machine learning model is making decisions. Based on our findings, we also derive design recommendations for future post-hoc explainability methods with increased comprehensibility and predictability.

cs.LG↗

arXiv2023

Exploring investor behavior in Bitcoin: a study of the disposition effect

Investors commonly exhibit the disposition effect - the irrational tendency to sell their winning investments and hold onto their losing ones. While this phenomenon has been observed in many traditional markets, it remains unclear whether it also applies to atypical markets like cryptoassets. This paper investigates the prevalence of the disposition effect in Bitcoin using transactions targeting cryptoasset exchanges as proxies for selling transactions. Our findings suggest that investors in Bitcoin were indeed subject to the disposition effect, with varying intensity. They also show that the disposition effect was not consistently present throughout the observation period. Its prevalence was more evident from the boom and bust year 2017 onwards, as confirmed by various technical indicators. Our study suggests irrational investor behavior is also present in atypical markets like Bitcoin.

econ.GN↗