arXiv CSopen access

Extending Blockchain Untraceability with Plausible Deniability

Extending Blockchain Untraceability with Plausible Deniability Eunchan Park, Kyonghwa Song, Won Hoi Kim, Wonho Song, and Min Suk KangB

arXiv:2605.13132v1 [cs.CR] 13 May 2026

KAIST Daejeon, South Korea {paul.park, song20, wh.kim, swh0329, minsukk}@kaist.ac.kr

Abstract—Traditional blockchain untraceability schemes, such as mixers and privacy coins, primarily aim to obscure the senderreceiver relationship of an asset transfer by placing it within an anonymity set. This paper studies a stronger goal: whether the asset-transfer event itself can be made unobservable by blending into common decentralized-finance (DeFi) activity. We introduce Deniable Covert Asset Transfer (DCAT), a class of transfers that deliberately stage common loss-producing events, such as sandwich and arbitrage operations, so that a sender appears to suffer an ordinary economic loss while the receiver appears to earn from that loss. We design and validate concrete DCAT instantiations across two representative blockchain execution environments: a sandwich-based instantiation on Ethereum and an arbitrage-based instantiation on Arbitrum. Our experiments demonstrate the empirical unobservability of DCAT under the evaluated settings across both chains. The evaluated transfers are syntactically identical to corresponding maximal extractable value (MEV) activities, are classified as ordinary extractions by standard MEV detection tools, and leave the sender and receiver unlinked under representative forensic tools. Since syntactic inspection cannot separate DCAT from ordinary MEV activity, we examine whether its economic semantics provide useful forensic signals. Through a large-scale empirical study of MEV losses across Ethereum and Arbitrum, we show that key semantic features exhibit power-law characteristics. Extreme losses and repeatedly exploited addresses occur in the wild, and thus are not, by themselves, definitive evidence of collusion. This gives staged transfers plausible deniability and makes fixedthreshold detection prone to false positives. We therefore develop a multivariate statistical method for forensic triage that ranks incidents by the joint rarity of their economic footprint. This method narrows a large search space to a manageable set of suspicious cases for manual investigation. Applying this method to real-world DeFi activity, we showcase three suspicious cases as examples of how such analysis can prioritize incidents for deeper investigation.

I. I NTRODUCTION Blockchain transactions are inherently transparent. To maintain a decentralized public ledger, every asset transfer is permanently recorded and globally verifiable, effectively rendering user financial histories fully traceable. Over the years, numerous works and real-world projects have attempted to overcome this inherent restriction by introducing transaction untraceability mechanisms to disconnect the link between a sender and a receiver of an asset transfer. By avoiding sending an asset directly from a sender to a receiver, these mechanisms make a sender and a receiver not directly linkable, thus rendering asset tracing difficult. Two notable untraceability

schemes widely used in the real world are mixers [1], [2], [3], [4], [5] and privacy coins [6], [7], [8], [9], [10]. The fundamental underpinning of these existing untraceability schemes is to make the true sender-receiver relationship one of many plausible relationships. Mixers and privacy coins achieve this through different mechanisms, but they share the same forensic goal: constructing a large anonymity set around an asset transfer. As a result, forensic analysis must reason over many plausible senders and receivers rather than a single explicit payment path. One limitation of this anonymityset approach, however, is that it protects the sender-receiver relationship more directly than the observability of the transfer event itself. That is, a mixer deposit or a privacy-coin transaction may hide the sender-receiver relationship, but the event remains visible and can still be flagged or prioritized for manual review. For example, participation in a recognizable mixer (e.g., Tornado Cash [2]) can itself remain visible on chain and serve as a forensic signal. This paper studies a stronger and qualitatively different goal. Rather than asking whether the sender and receiver can be linked from visible transfers, we ask whether the asset-transfer event itself can be made indistinguishable from routine decentralized-finance (DeFi) activity. We call this class of techniques Deniable Covert Asset Transfer, or DCAT. In a DCAT transfer, the sender appears to suffer an ordinary economic loss, while the receiver appears to earn ordinary market profit from that loss. The economic value moves from the sender to the receiver, but the observable transaction sequence resembles a common market event rather than an explicit asset transfer. The key insight behind DCAT is that DeFi systems contain frequent loss-producing events. Examples include sandwich extractions, arbitrage events, liquidations, and other forms of maximal extractable value (MEV) activity [11], [12], [13], [14], [15]. For example, a recent work [15] reports 1,209,139 sandwich and 1,295,829 arbitrage events on Ethereum from January 2023 to December 2024. A recent study also reports MEV activity in layer-2 systems such as Arbitrum [14]. DCAT exploits this background activity by deliberately staging such an event between two colluding addresses. The sender creates a transaction that exposes value to extraction, and the receiver captures the induced loss through a transaction pattern that matches routine market behavior. As a result, the receiver’s gain appears to be MEV profit rather than the endpoint of a

covert asset transfer. Recent public discussions and emerging research suggest that DeFi execution semantics may be abused to move value without leaving a conventional transfer path [16], [17], [18], [19]. These observations raise a broader systems-security question that remains insufficiently understood: when can such value movement become not only hard to attribute, but hard to observe as an asset transfer at all? We answer this question by systematizing DCAT as an unobservability problem in blockchain systems. Our goal is not to introduce a deployable privacy service, but to expose a forensic blind spot created by the interaction between DeFi market mechanics and existing graph-based forensic tracing methods. We design and demonstrate DCAT across different economic loss events in layer-1 and layer-2 public blockchain systems. In particular, we present end-to-end experiments demonstrating sandwich-based DCAT on Ethereum Hoodi Testnet and arbitrage-based DCAT on Arbitrum Sepolia testnet. Across both chains, the evaluated DCAT transfers are syntactically identical to common MEV activities while moving a substantial fraction of the sender’s assets to the receiver. Representative forensic tools fail to reconstruct the sender-receiver relationship because they stop at high-traffic decentralized-exchange contracts and leave the sender and receiver unlinked. This result demonstrates the empirical unobservability of DCAT across two representative blockchain execution environments. A natural response is then to ask whether DCAT can be detected semantically rather than syntactically. Although a DCAT event may look like ordinary MEV activity at the transactionpattern level, its economic intent differs: organic MEV is adversarial and opportunistic, while DCAT is cooperative and deliberately loss-inducing. This suggests that DCAT transfers might be isolated by looking for extreme extraction volumes or repeated losses by the same sender. However, through a largescale empirical study of MEV activities across Ethereum and Arbitrum, we show that key semantic features in our observed dataset exhibit power-law characteristics across both chains. Extreme losses and repeatedly exploited addresses occur in the wild, and thus a high-value or severe loss event is not, by itself, definitive evidence of collusion. A deterministic threshold can either flag many false positives or miss carefully tuned DCAT transfers, giving staged transfers plausible deniability and making fixed-threshold detection brittle. Nevertheless, this limitation does not preclude forensic triage. For investigations where the stakes justify manual review, such as large-scale illicit fund tracing, the practical goal is often not fully automated attribution but effective prioritization. To this end, we develop a multivariate statistical method for ranking suspicious incidents. The method models the joint distribution of multiple semantic features and ranks incidents by how statistically rare their combined economic footprint is under the baseline of MEV activity in the wild. Investigators can use the resulting ranking to narrow a large search space to a manageable set of suspicious cases for manual review. We apply this method to real-world DeFi

activity and showcase three suspicious cases that illustrate how our multivariate analysis can surface incidents that merit deeper investigation. This paper makes the following contributions. • We systematize DCAT as an unobservability problem in blockchain systems (§III). DCAT hides economic value movement inside routine loss-producing DeFi activity rather than inside an explicit anonymity set of transfers. • We design and validate concrete DCAT instantiations across two execution environments (§IV): a sandwich-based DCAT and an arbitrage-based DCAT on Ethereum and Arbitrum testnets, respectively. We show empirical unobservability under the evaluated settings across both chains. • We conduct a large-scale empirical study of MEV losses (§V). We show that key semantic features exhibit power-law characteristics, which gives extreme staged losses plausible deniability and limits simple threshold-based detection. • We develop a multivariate statistical method for forensic triage that prioritizes suspicious incidents for manual review by modeling the joint rarity of their economic footprint (§VI). We showcase three real-world cases surfaced by this analysis. II. BACKGROUND AND R ELATED W ORK This section provides the technical background and related work needed to position DCAT. We first review existing blockchain untraceability schemes, focusing on how mixers and privacy coins rely on anonymity sets to obscure senderreceiver relationships (§II-A). We then summarize blockchain forensic techniques and their reliance on explicit transactionflow reconstruction (§II-B). Finally, we discuss prior public speculation and emerging research on MEV-assisted value movement, clarifying how our work differs by systematizing DCAT as an unobservability problem and empirically studying its feasibility, forensic limitations, and detection prospects (§II-C). A. Untraceability via Anonymity Sets Given the inherent transparency property of blockchains, many untraceability schemes [1], [2], [3], [4], [5], [6], [7], [20], [21] have been proposed to obscure relationships among protocol participants. A core goal of these schemes is to prevent an observer from confidently linking a sender to the corresponding receiver after inspecting on-chain data [22]. Most existing schemes pursue this goal by constructing anonymity sets over candidate senders and receivers. That is, even when candidate participants are known, forensic analysis should not be able to identify which sender corresponds to which receiver with high confidence. We next review two prevalent classes of such schemes and how they construct anonymity sets. Blockchain mixers, such as CoinJoin [1] and Tornado Cash [2], pool funds from multiple users and later distribute them to designated recipient addresses, creating an anonymity set of participants. This pooled redistribution obscures the

2

direct relationship between each sender and its intended receiver. Depending on the design, mixers may operate through a centralized service [3], [4] or a decentralized protocol [2], [5], and may support fixed denominations [1], [23] or variable deposit amounts [24]. Regardless of these design choices, their common objective is to make multiple sender-receiver pairings plausible within the pool, thereby weakening direct transaction-flow tracing. Privacy coins [6], [7], [8], [9], [10] embed anonymity mechanisms directly into the blockchain protocol, providing anonymity sets at the protocol level. Zerocoin [6] and its successors [7], [8], [9] use zero-knowledge proofs to decouple coin deposit from later spending, ensuring that no observer can link the two events. Monero [10] uses ring signatures to conceal the true sender-receiver relationship. These mechanisms construct anonymity sets by design, making participants indistinguishable within a set of plausible senders or receivers.

C. Prior Discussions on MEV-Assisted Value Movement Prior to this work, there existed public speculation regarding the use of MEV extraction as a vehicle for covert asset transfer. Following a massive MEV extraction event in March 2025, several articles [16], [17], [18] raised suspicions that the extraction may have constituted money laundering disguised as MEV activity. The incident prompted debate among industry experts, including personnel from Cyvers, Hacken, DefiLlama, MetaMask, Flashbots, and Uniswap. Nevertheless, no formal follow-up investigation was conducted to determine whether such large-scale extractions indeed represented laundering behavior, leaving these claims unsubstantiated. More recently, Cao et al. [19] published an arXiv preprint that independently discusses a related form of covert value movement through DeFi execution semantics. The preprint articulates a mechanism closely related to the transfer technique studied in this paper. At the same time, however, it addresses a narrower scope than the systems-security questions we study here. In particular, the preprint focuses primarily on modeling, leaving open broader security questions about the underlying unobservability properties, practical feasibility, and forensic detectability of such transfers. Our work builds on this emerging line of discussion and provides a systems-security study of MEV-assisted covert asset transfer. We systematize DCAT as an unobservability problem, validate concrete instantiations across Ethereum and Arbitrum, analyze why simple semantic detection is limited, and develop an advanced forensic-triage method for prioritizing suspicious real-world cases.

B. Transaction-Graph Forensics In response to the growing use of blockchain for illicit activity [25], [26], forensic techniques have evolved along two directions, each tailored to the UTXO-based and accountbased blockchains. First, UTXO-based blockchain forensics dates back to 2013, when several influential works [27], [28], [29], [30] introduced two foundational heuristics for tracing Bitcoin transactions: (1) the co-spending heuristic posits that all input addresses of a transaction are controlled by the same entity, and (2) the shadow address heuristic assumes that the change output of a UTXO transaction is returned to an address owned by the same entity as the inputs. By applying these, prior works constructed address relationship graphs that cluster addresses controlled by the same entity. Subsequent research extended these foundations by refining clustering heuristics, enriching transaction graphs with contextual role annotations [31], [32], validating forensic methodologies through law-enforcement practice [33], and developing specialized frameworks for tracing illicit fund flows such as ransomware payments [34], [35]. More recently, Kappos et al. [36] further improved clustering by combining machine learning with structural transaction patterns such as peel chains. Second, the account-based model employed by blockchains such as Ethereum introduces structural differences from UTXO-based designs, leading to corresponding adaptations in forensic methodology. Unlike Bitcoin forensics, Ethereum tracing lacks a de facto standard heuristic; existing approaches instead follow explicit transaction flows and apply targeted heuristics to reduce false positives. For instance, prior work has proposed heuristics for high-confidence address clustering [37], score-based relationship graphs for source attribution [38], taint-analysis frameworks for tracing illicit flows in real-world heists [39], and biased graph-search techniques that incorporate transaction-level details into tracing [40].

III. D ENIABLE C OVERT A SSET T RANSFER Unlike conventional untraceability schemes surveyed in the previous section, which rely on anonymity sets, DCAT takes a different approach: it hides asset movement inside a staged loss event that is common in the DeFi ecosystem. In this section, we first formalize the adversary model in which DCAT operates (§III-A), develop the core intuition through a concrete toy example (§III-B), and discuss practical factors that affect real-world feasibility (§III-C). A. Threat Model For the purpose of this paper, we focus on the adversarial setting of DCAT, where a malicious actor seeks to transfer assets in an untraceable manner by exploiting on-chain economic loss events. Note, however, that DCAT can also be utilized in a non-adversarial context, such as by users seeking to enhance their privacy without malicious intent. Under this adversary model, we define the adversary’s capabilities and objectives as follows. The DCAT adversary seeks to transfer a target digital asset from a sender address to a receiver address in an untraceable manner, without relying on well-known mechanisms such as mixers and privacy coins. This motivation is practical: existing privacy mechanisms are often recognizable onchain and have received substantial regulatory and forensic scrutiny [41]. An

3

recorded and may later be use for forensic tracing. The goal is therefore to move value without leaving a traceable link from S to R. To initiate the process, the DCAT adversary uses S to execute a standard token swap (❷) on a decentralized exchange (DEX), such as Uniswap, attempting to exchange BTC for ETH. Such a swap is fully transparent to the public and thus does not offer any inherent untraceability. The obfuscation occurs when the adversary uses the designated address R as a sandwicher to execute a staged sandwich operation targeting the sandwichee address S’s Uniswap transaction. To achieve this, R submits a frontrunning transaction (❶) immediately before S’s swap (❷) and a backrunning transaction (❸) immediately after. The frontrunning transaction purchases ETH ahead of S, inflating its exchange rate; S’s swap then executes at this unfavorable rate, resulting in a significant loss; finally, the backrunning transaction sells the ETH acquired in the frontrun at the now-elevated price, capturing the profit. This standard sandwich operation deliberately manipulates the local exchange rate, allowing R to extract a profit directly from the financial loss incurred by S. After the staged sandwich concludes, R holds the extracted profit as ordinary MEV revenue. How much is transferred? The transferred amount corresponds to the profit retrieved by the receiver from the staged loss. In our toy example, the adversary aims to maximize the proportion of S’s loss that is captured by R. By deliberately configuring transaction parameters, most notably by setting a high slippage tolerance on S’s swap, the adversary ensures that the induced loss is maximized. As a result of this orchestrated sequence, S incurs a loss of 33.3 BTC, while R’s balance increases by 33.3 BTC, assuming a stable market rate of 1 BTC = 10 ETH. That is, this DCAT operation successfully transfers 33.3 BTC from S to R, which is 66.7% of S’s original 50 BTC. This toy example reports the gross transferred amount, abstracting away operational costs such as transaction fees for simplicity. In practice, these costs slightly reduce the receiver’s net gain and therefore the transfer effectiveness, but the reduction is expected to be marginal when the transferred value is sufficiently large. Unobservability intuition. We now explain why the staged sequence is difficult to recognize as an asset transfer under existing tracing heuristics. When a forensic tool traces from S, it fails to cluster S with R because existing tools typically treat high-traffic smart contracts such as DEXs as terminating points of each exchange transaction, rather than as intermediaries that facilitate asset transfer. At the same time, the transaction sequence matches the structure of a standard sandwich operation. As a result, existing tools are likely to interpret the sequence as ordinary MEV activity rather than as a deliberate transfer from S to R.

DCAT asset movement

1

R Wallet A

2

S

time

Wallet B

3

R Wallet A

S

50 BTC 333 ETH

33.3 BTC

R

Uniswap

50 BTC 167 ETH

Uniswap

500 ETH 100 BTC

S

$$

R

Yet another sandwich… Uniswap

Existing heuristics

Figure 1. A toy example of the sandwich-based DCAT attack. The DCAT sender (S) and receiver (R) stage a sandwich extraction on the Uniswap DEX (❶–❸). Existing heuristics are limited to interpreting it as yet another sandwich operation (thus failing to recognize it as a deliberate transfer) while a significant amount of assets (33.3 BTC) is transferred from S to R in an unobservable manner.

adversary may therefore seek a transfer mechanism that does not appear as participation in a known untraceability service. We consider the adversary to have no capabilities beyond those available to any benign blockchain participant: they may submit transactions to the network, interact with arbitrary smart contracts, and optionally participate in the consensus mechanism of the underlying chain. The adversary does not possess privileged access to any protocol component, network infrastructure, or any vulnerability in the system that is unavailable to ordinary users. In addition to the target asset held by the sender, the adversary may control separate working capital at the receiver address. This working capital is not the value being covertly transferred, but a reserve used to execute the staged market action that captures the sender’s induced loss. We assume that this reserve is operationally separate from the target asset, so the observable outcome remains a sender-side loss and a receiver-side market profit rather than a direct transfer. B. High-level Intuition with a Toy Example A toy example. We illustrate the core intuition of DCAT using the toy example in Figure 1. Consider an adversary who controls two addresses, S and R, and wishes to move digital assets from S to R without creating an observable transfer event. In this toy example (and throughout the remainder of the paper), we use a sandwich operation as the running example of an economic loss event because it is a common MEV activity within the current DeFi ecosystem [11]. Let us walk through the sequence of events illustrated in Figure 1, where S operates as the DCAT sender and R serves as the DCAT receiver. The core of the DCAT transfer is the highlighted three-transaction sandwich sequence. Prior to this sandwich operation, address S holds 50 BTC, and address R holds 50 BTC and 167 ETH. The adversary controls both addresses and intends to move part of the value held by S to R. The adversary is aware that S’s transaction history is publicly

C. From the Toy Example to Real-World Feasibility Although the toy example captures the core idea, realizing it in practice requires careful operational planning. We discuss three factors that an adversary should consider for effective

4

execution of a sandwich-based DCAT transfer and briefly survey the landscape of exploitable DEX swap pools in the wild.

sandwich-based transfer on Ethereum Hoodi Testnet (§IV-B) and an arbitrage-based transfer on Arbitrum Sepolia testnet (§IV-C).

• DEX types. To achieve a DCAT transfer with a significant amount, the adversary would need to choose a DEX that is particularly susceptible to exchange rate manipulation, as the profit margin of a sandwich operation is directly tied to the degree of price impact it can induce. Uniswap is one of the most widely used DEXs today [42], with an average of 14.1 million monthly active users as of 2025 [43]. Uniswap V2 is particularly well-suited as its constantproduct formula (x · y = k) distributes liquidity uniformly across the entire price curve, producing a nonlinear impact on the exchange rate. For example, a swap that induces a $10 loss at $100 input can exceed $100 in loss when scaled to $1,000. The toy example (§III-B) therefore uses Uniswap V2-style constant-product DEX.

A. Mechanics of Unobservability To define the privacy guarantees of DCAT, we ground our evaluation in the established taxonomy introduced by Pfitzmann and Köhntopp [22], who define unobservability as “the state of items of interest (IOIs) being indistinguishable from any IOI at all.” In our threat model, the primary IOI is the deliberate, covert asset transfer between a sender and a receiver. DCAT does not merely obscure the identities behind a known transfer; instead, it aims to make the occurrence of the transfer itself indistinguishable from routine, non-transfer ecosystem activity. This state of unobservability is achieved through the intersection of two distinct characteristics: the syntactic identity of the staged transactions and the structural blind spots inherent in modern forensic methodologies. Indistinguishability via syntactic identity. Syntactic identity serves as the fundamental mechanism that enables this indistinguishability from the routine organic extractions in the ecosystem. DCAT orchestrates economic loss events that carefully mirror the transaction types, ordering, and state changes of organic MEV extractions, such as sandwich attacks or arbitrages. By strictly adhering to the expected structural footprint of common market loss activities, DCAT avoids triggering mechanized anomaly detections. Consequently, when automated detection systems or analysts observe the event, they classify DCAT transfers as routine economic events, establishing the plausible deniability necessary to mask the underlying IOI. Structural blind spots in forensics. DCAT’s camouflage may still fail if forensic entities can exhaustively trace all interconnected asset flows used in the DCAT transfer. DCAT secures its unobservability by deliberately operating within the structural blind spots of existing forensic clustering algorithms. Existing forensic tools categorically exclude high-traffic smart contracts, such as DEXs, from their address clusters to prevent massive false-positive explosions. For this practical reason, they choose to treat these contracts as terminating endpoints rather than shared intermediaries. DCAT exploits this limitation by operating the covert transfer through these untraceable boundaries. Achieving unobservability. Consequently, it is the combination of these two characteristics that renders the DCAT transfer unobservable. Syntactic identity ensures that the transaction is immediately classified as background MEV noise, preventing initial suspicion. Concurrently, the structural blind spot ensures that forensic tools would halt their clustering at the DEX contract, ensuring that the hidden multi-hop transfer is not reconstructed. Because the event appears entirely ordinary on the surface and occurs exactly where forensics overlook, the deliberate asset transfer remains indistinguishable from the absence of a transfer, matching our operational criterion for empirical unobservability.

• Capital and pool liquidity. The ratio of swap input to pool liquidity governs the degree of exchange rate manipulation, so the adversary must estimate the expected loss for a given capital deployment prior to execution. A critical constraint is that exchange rate inflation must not exceed the point at which the backrunning transaction can no longer recover most of the induced loss. From our toy example, if the adversary cannot fund the additional 167 ETH for R and can only backrun with the swapped 333 ETH, it can only receive 80 BTC instead of 100 BTC, leaving 20 BTC in the pool. Within this constraint, effectiveness scales monotonically with capital deployment. • Single vs. multiple transfers. An adversary could transfer a large lump sum in a single DCAT transfer, as shown in the toy example, but this may not always be feasible due to capital constraints. In such cases, the adversary can use multiple DCAT transfers, each transferring a portion of the total amount, to achieve the overall transfer goal. Exploitable DEX swap pools in the wild. To assess realworld feasibility, we surveyed available Uniswap V2 pools via Dune Analytics [44] and identified approximately 4,800 pools that could be exploited for the sandwich-based DCAT attack in the toy example. The number of exploitable pools depends on the adversary’s available capital. For example, an adversary deploying approximately $2,000 ($900 for the sender and $1,100 for the receiver) to transfer roughly $600 in a single DCAT transfer can exploit approximately 2,000 of these pools. As the adversary’s capital increases, the number of exploitable pools grows accordingly. IV. E MPIRICAL VALIDATION OF U NOBSERVABILITY We now empirically validate that DCAT can be executed end-to-end and can reproduce the observable structure of ordinary MEV activity. Our goal is to test the two properties that underlie DCAT’s unobservability: syntactic identity with organic MEV incidents and evasion of existing graph-based forensic tracing. We first define these mechanics (§IV-A), and then validate them across two execution environments: a

5

scheduled to propose the next block, the adversary submits the sandwichee’s (i.e., the DCAT sender’s) transaction to the public mempool. The searcher simultaneously constructs a DCAT sandwich bundle, syntactically identical to a standard sandwich, and submits it to the block builder. Because the colluding validator recaptures the bid, the adversary’s builder submits an arbitrarily high bid to guarantee inclusion, completing the covert transfer while preserving the outward appearance of an ordinary sandwich incident. Validating syntactic identity. We have successfully executed a DCAT transfer in the Hoodi testnet, and our DCAT transfer is visible in the explorer123 . To confirm that our DCAT transfer is syntactically identical to an organic sandwich at the transaction level, we analyzed the crafted incident using a widely used open-source sandwich detection tool [52]. This tool flags a well-known three-transaction pattern in which the first and third transactions originate from the same address, all three interact with the same DEX, and the first and second swap the same token pair while the third swaps in the reverse direction. In our executed incident, our sandwicher 0x11 and the sandwichee 0xEA interacted with our custom Uniswap pair 0x3E, exactly reproducing this structural pattern. The detection tool successfully classified our DCAT incident as an ordinary sandwich, empirically confirming that the required syntactic structure was replicated. Validating evasion of forensics. Confirming the syntactic identity, we now empirically validate the unobservability (§IV-A) of the orchestrated DCAT transfer demonstrated in the network. For this purpose, we applied two representative open-source Ethereum forensic tools [37], [40] to the DCAT transfer. Both tools either failed to link the DCAT sender to the receiver because they excluded the shared DEX contract, or produced a massive false-positive explosion when attempting to cluster through the shared DEX. These outcomes highlight a fundamental limitation inherent to existing forensic tools. To the best of our knowledge, existing graph-based forensic methods do not provide a reliable way to trace through hightraffic DEX contracts without incurring a false-positive explosion. This suggests that DCAT resides within a systematic blind spot of the evaluated forensic tools and remains unlinked under the evaluated tracing methodologies.

B. Validation on Ethereum: Sandwich-based DCAT We now empirically validate the syntactic identity and forensic blind spots by executing an end-to-end DCAT transfer in a live environment, beginning with a sandwich-based instantiation on Ethereum. Our validation proceeds in three steps: we first construct the transfer, then confirm that a widely used detection tool classifies it as an organic sandwich, and finally show that existing forensic tools fail to link the sender and receiver. To create DCAT transfers syntactically identical to organic sandwich incidents, we demonstrate it with the same pipeline through which organic sandwiches are produced: the ProposerBuilder Separation (PBS) architecture [45]. PBS distributes block construction across four roles. Searchers identify profitable sandwich opportunities and submit them as transaction bundles to builders; builders assemble these bundles into complete blocks, attach a bid, and forward the block to a relay; the relay forwards the highest-bid block to the assigned validator, who proposes it and receives the corresponding bid; refer to [45] for a detailed description of the PBS ecosystem. To stage a sandwich operation that flows through this pipeline, a DCAT adversary should operate its own searcher and builder. Both roles are inexpensive to operate, as opensource implementations are publicly available, and neither requires specialized hardware or staked capital. The adversary may additionally operate its own validator; while not strictly required, doing so improves reliability and eliminates the dominant operational cost of the transfer. This is because, without controlling the block-proposing validator, the builders in PBS have to compete in a bid auction and pay the bid to the proposing validator to propose its block; this bid constitutes an operational cost for the adversary. When the validator is under adversarial control, however, the bid simply returns to the adversary, allowing its builder to submit an arbitrarily high bid and guarantee inclusion. The only remaining task is to wait for the adversarial validator to be assigned a proposal slot and to ensure the builder submits its bid within the 12-second block time. This opportunistic aspect of the attack is acceptable when the adversary can wait for an assigned proposal slot, given the unobservability benefit and high transfer effectiveness of the DCAT transfer. Testbed environment and execution. We conducted our experiments on the Hoodi testnet, which provides a live but isolated Ethereum environment for experiments. For the block builder, we used Flashbots’ rbuilder 1.3.7 [46], configured to connect to a public Flashbots relay [47]. For the validator, we used Lighthouse 8.1.0 [48] as the consensus client, Reth 1.11.0 [49] as the execution client, and MEV-Boost [50] configured to connect to the same relay. For an identical setting with the mainnet, we deployed a liquidity pool for a custom ERC-20 token pair using a fork of the Uniswap V2 codebase [51]. We then ran a custom Python-based searcher that monitors our validator’s scheduled proposal slot and orchestrates the transfer as follows. When the adversary’s validator is

C. Validation on Arbitrum: Arbitrage-based DCAT We next validate the same unobservability mechanism on the Arbitrum layer-2 execution model. Unlike Ethereum, Arbitrum uses a centralized sequencer that orders transactions on a first-come-first-served basis, which renders standard frontrunning challenging, making arbitrage the dominant extraction strategy instead, as reported earlier by Ferreira et al. [14]. Consequently, the DCAT adversary adapts its staged loss to 1 https://hoodi.etherscan.io/tx/0xb56889b4cefdfd32c30e57050ec6f492bc7b 65fe5ef40c540542b11f6489a2cc 2 https://hoodi.etherscan.io/tx/0x0da364ef963b2820c38fe20799a3d9b785d1 a66e12f13e8dce3277babe7125cb 3 https://hoodi.etherscan.io/tx/0x6d59cdb4f251447f47c1414159d35716ac9e 0e565306f3afc180dc3a961b8e93

6

an arbitrage, mimicking an organic arbitrageur who exploits a sudden price discrepancy. An arbitrage-based DCAT transfer is produced by two sequential transactions. First, the DCAT sender submits a rateinflating swap that intentionally skews the exchange rate of a target pool. The DCAT receiver then submits a backrunning arbitrage transaction that captures the staged loss before another non-colluding arbitrageur can intervene. A critical constraint is that these two transactions must land in different blocks. This is because, as Arbitrum has no public mempool, arbitrageurs can observe the inflated exchange rate only after the rate-inflating transaction is published on-chain; consequently, a rate-inflating transaction and an arbitrage transaction appearing in the same block would itself constitute observable evidence of collusion. The adversary must therefore time its submissions precisely: submitting the arbitrage transaction too early risks co-inclusion with the rate-inflating swap, while submitting too late risks preemption by a competing arbitrageur. Testbed environment and execution. To demonstrate that this timing constraint can be satisfied in practice, we deployed our experimental setup on the Arbitrum Sepolia testnet. We used two AWS EC2 instances to submit transactions: one in Ohio to submit DCAT transactions with minimal latency to the Arbitrum sequencer in Ohio, and another in North Virginia to send probing transactions that help estimate block boundaries with high precision. Similar to the Ethereum setup, we deployed a liquidity pool for a custom ERC-20 token pair using a fork of Uniswap V2 [51]. To reliably estimate the block boundary, we consistently sent probing transactions disguised as normal transfers, initiating the DCAT transfer only upon confirming the exact boundary. This strict timing ensures that the rate-inflating transaction lands at the very end of one block, allowing the arbitrage transaction to execute in subsequent blocks. As a result, this probing strategy achieves a 98.3% success rate in a practical setup; we defer the fine-grained timing analysis to Appendix A. Validating syntactic identity. We have conducted the arbitrage-based DCAT transfer in the Arbitrum Sepolia testnet, and both of our rate-inflating and arbitrage transactions are visible in the explorer45 . Using the arbitrage-based DCAT conducted in the network, we now verify the DCAT transfer’s syntactic identity by analyzing our crafted incident using a standard open-source arbitrage detection tool [52]. This tool identifies arbitrage events by tracing swap histories for an arbitrage transaction that forms a closed cycle of asset movements6 following a rate-inflating transaction. In our execution, the receiver 0xCD executed an arbitrage swap against the inflated pool 0x25, captured the staged loss incurred by the

sender 0x07 two blocks earlier, and swapped back to the original asset type. The detection tool accordingly classified our incident as a standard arbitrage event, confirming that the expected syntactic structure was replicated. Validating evasion of forensics. We also test our own DCAT transfers in the Arbitrum Sepolia testnet against available forensic tools. Similar to our sandwich-based DCAT transfer, the forensic tracing tools [37], [40] again either halted their cluster expansion at the shared DEX contract to avoid a falsepositive explosion or resulted in a false-positive explosion by clustering the shared DEX, leaving the sender and receiver unlinked. By reproducing this outcome across distinct layer-1 and layer-2 execution models, we show that DCAT’s unobservability mechanism is not tied to a single chain architecture. V. S EMANTIC D IVERGENCE AND F ORENSIC L IMITATIONS In the previous section, we showed that DCAT transfers can reproduce the syntactic structure of organic market activity. This syntactic identity, however, does not imply semantic equivalence. Organic MEV extractions are adversarial and opportunistic while DCAT transfers are cooperative and deliberately loss-inducing. This section examines whether this semantic difference can support forensic inspection. We first introduce the idea of isolating DCAT transfers by analyzing the economic behavior of transacting entities (§V-A). We then build empirical baselines from large-scale MEV activity on Ethereum and Arbitrum (§V-B), showing that the relevant extraction features exhibit power-law characteristics. Finally, we explain why these heavy-tailed baselines make fixedthreshold inspection brittle and provide plausible deniability for staged losses (§V-C). A. Intuition for Threshold-based Semantic Inspection The high-level intuition behind semantic inspection is that DCAT and organic MEV activity, while syntactically similar, differ in their economic intent. In organic MEV, extraction is adversarial and opportunistic. An extractee inadvertently exposes value to extraction, which an independent extractor captures. Thus, the organic extractee may have incentives to reduce such losses, for example, by setting tight slippage tolerance [53] or by avoiding repeated exposure from the same address. In contrast, DCAT relies on cooperation between the sender and receiver. The DCAT sender deliberately weakens these guardrails to induce a large loss that the receiver can capture as apparent MEV profit. This suggests a simple semantic inspection strategy: identify unusually large losses, unusually high extraction ratios, or repeated extraction patterns that deviate from ordinary MEV behavior. To test whether such threshold-based inspection is viable, we conduct a large-scale empirical study of MEV extractions in the wild.

4 https://sepolia.arbiscan.io/tx/0x82811aa91ab862cc7afec0ebf52825de05a 01df7923caa6b5040e0022f5bb3b7 5 https://sepolia.arbiscan.io/tx/0x737f4641e4522b5327a8b22c03703bc9ba7 7593b0b787adde1b6c90edb7c94df 6 A closed-cycle design allows the arbitrageur to hold assets in a single asset type, simplifying arbitrage across multiple asset types. This is a common practice since the contract can be reused without changing any arguments.

B. Semantic Features in Underlying MEV Activities To assess the practical feasibility of semantic inspection, we conducted a large-scale measurement study of MEV activities

7

100 10 1 10 2 10 3 10 4 10 5 : 2.23 6 10 10 2 100 102 104 106 Extraction volume in USD (log scale)

CCDF=Pr(X x) (log scale)

occurring on layer-1 Ethereum and layer-2 Arbitrum. Our analysis focuses on four features that capture the economic magnitude and long-term operational patterns of each MEV activity: • [F1] Extraction volume: The absolute profit captured by an extractor. This corresponds to the transferred amount in a DCAT transfer. • [F2] Capital-extraction ratio: An extractee’s loss expressed as a fraction of its swapped capital. This reflects the severity of the extractee’s guardrail bypass.

(a) CCDF of extraction volume in Ethereum

100 10 1 10 2 10 3 10 4 : 2.24 5 10 10 3 10 1 101 103 105 Extraction volume in USD (log scale)

(b) CCDF of extraction volume in Arbitrum

Figure 2. CCDF of the [F1] extraction volume on Ethereum (a) and Arbitrum (b).

• [F3] Bilateral extraction frequency: The number of incidents involving the same extractor-extractee pair. A high frequency might indicate repeated interaction between the same two addresses.

CCDF=Pr(X x) (log scale)

100 10 1 10 2 10 3 10 4 10 5 : 2.36 6 10 10 0 10 4 10 8 10 12 10 16 Distance to full extraction (1 x) (log scale, reversed)

• [F4] Extractee exploitation frequency: The total number of times a specific extractee address is targeted across all extractors. A high frequency may indicate an address that repeatedly exposes value to extraction. We selected these four features because they explicitly quantify the economic guardrails discussed previously. To transfer a substantial amount of value, an adversary may need to drive some of these metrics to large values, thereby possibly diverging from the baseline behavior of ordinary users. Data collection. We establish an empirical statistical baseline of extraction activities from two representative MEV ecosystems: sandwich and arbitrage exploitations on Ethereum and Arbitrum, respectively. We gathered sandwich incidents on Ethereum using Mev-inspect-py [52] and arbitrage incidents on Arbitrum using the open-source code published by Ferreira et al. [14], [54]. For each incident, we reconstruct the profit and loss in USD at the moment of extraction, using prices obtained from CoinGecko [55]. Our data collection spans March 8, 2025 to December 13, 2025 (block numbers 22,000,000 to 23,999,999) for Ethereum and March 1, 2025 to April 20, 2025 (block numbers 310,947,140 to 327,902,139) for Arbitrum. From the collected dataset, we exclude incidents involving cryptocurrencies for which CoinGecko does not provide reliable price data (e.g., meme coins with extreme price volatility or assets lacking USD price feeds), accounting for approximately 43.1% of incidents on Ethereum and 63.3% on Arbitrum. Our data covers a total 313,219 sandwich incidents on Ethereum and 55,482 arbitrage incidents on Arbitrum. Highlights: power-law characteristics. Our primary question is whether large losses and repeated extraction patterns are rare enough to serve as reliable forensic separators. If ordinary MEV activity already contains heavy-tailed extraction behavior, then a staged DCAT transfer can remain plausible even when it appears economically severe. Our results show that the relevant semantic features exhibit power-law characteristics. For unbounded features such as [F1] extraction volume, [F3] bilateral extraction frequency, and [F4] extractee exploitation frequency, a power-law tail means that increasingly large observations remain part of the same scalefree empirical pattern rather than forming a clearly separated regime. For the bounded [F2] capital-extraction ratio, the

(a) CCDF of capital extraction ratio in Ethereum

100 10 1 10 2 10 3 10 4 : 2.44 5 10 10 0 10 1 10 2 10 3 10 4 Distance to full extraction (1 x) (log scale, reversed)

(b) CCDF of capital extraction ratio in Arbitrum

Figure 3. CCDF of the [F2] capital-extraction ratio on Ethereum (a) and Arbitrum (b).

analogous behavior appears near the upper boundary: values can approach full extraction closely, and the observed tail shows that near-boundary losses also occur in the baseline. We present these characteristics for all four features on Ethereum and Arbitrum. Although the fitted tail behavior varies across features and chains, the common pattern is that simple magnitude-based thresholds do not provide a clean separation between ordinary MEV activity and staged losses. A canonical visual indicator of power-law characteristics is an approximately straight line on a log-log Complementary Cumulative Distribution Function (CCDF). This visual signature is shown across all Figures 2–5. To better quantify the power-law characteristics in the tail, we evaluate the tail exponent (α), which characterizes the rate of tail decay (smaller is heavier), with empirical power laws typically lying in (2, 3) [56], [57]. [F1] Extraction volume. As shown in Figure 2, the CCDF of extraction volume is approximately linear on a log-log scale on both chains, exhibiting the canonical visual signature of a power law. The tail exponents (α = 2.23 on Ethereum, α = 2.24 on Arbitrum) sit well within the empirical (2, 3) range, indicating a tail heavy enough that the theoretical variance diverges. A heavy-tailed extraction-volume baseline weakens magnitude-only separation of high-value DCAT transfers; that is, because observed incidents produce five- or even six-figure extractions, a staged DCAT transfer of comparable size is not automatically separable by magnitude alone. [F2] Capital-extraction ratio. The capital-extraction ratio also exhibits power-law characteristics. Although this ratio

8

CCDF=Pr(X x) (log scale)

100 10 1 10 2 10 3 10 4 10 5 : 2.61 6 10 10 0 101 102 103 104 Bilateral extraction frequency (log scale)

(a) CCDF of bilateral extraction frequency in Ethereum

100 10 1 10 2 10 3 10 4 : 2.29 5 10 10 0 101 102 103 Bilateral extraction frequency (log scale)

C. Inherent Limitations of Threshold-Based Semantic Inspection The consequence for forensic analysis is that thresholdbased semantic inspection has no stable operating point. A power-law tail is scale-free; namely, there is no characteristic magnitude at which an observation becomes categorically separate from the rest of the distribution. For the unbounded features, such as extraction volume and frequency-based measures, the distribution has no definitive upper bound, and increasingly large observations remain part of the same empirical tail. Moreover, for tail exponents in the range observed in our data, these unbounded values can drive the variance to infinity, even though the sample mean and variance can always be computed on any finite dataset.7 For the bounded capital-extraction ratio, the analogous phenomenon appears near the boundary; that is, values can approach full extraction arbitrarily closely, and the observed tail indicates that nearboundary losses are not isolated measurement artifacts. This tail behavior makes any fixed threshold inherently brittle. A low threshold could flag many false positives, while a high threshold could allow carefully staged DCAT transfers to blend into the tail of other MEV activity. Thus, magnitude alone cannot provide a definitive separation of deliberate DCAT transfers, even when the observed loss is unusually large or repeatedly associated with the same address pair. This limitation also explains why threshold-based evidence provides plausible deniability rather than attribution. Semantic features may still be useful for prioritizing suspicious incidents, but they are insufficient as deterministic indicators. This motivates the rank-based analysis in the next section, which treats semantic evidence as a triage signal rather than as a binary detection rule.

(b) CCDF of bilateral extraction frequency in Arbitrum

100

100

CCDF=Pr(X x) (log scale)

Figure 4. CCDF of [F3] bilateral extraction frequency on Ethereum (a) and Arbitrum (b).

10 1

10 1

(a) CCDF of extractee exploitation frequency in Ethereum

(b) CCDF of extractee exploitation frequency in Arbitrum

10 2 10 3

10 2

10 3 : 2.57 : 2.16 5 4 10 10 0 101 102 103 104 10 100 101 102 103 104 Extractee exploitation frequency Extractee exploitation frequency (log scale) (log scale) 10 4

Figure 5. CCDF of [F4] extractee exploitation frequency on Ethereum (a) and Arbitrum (b).

is inherently bounded within the range of [0, 1) (since an extractee cannot lose more than the initial capital and some non-zero fees are always incurred), the ratio can be infinitely close to one. Figure 3 measures how close the ratio gets to one in terms of its distance to one (i.e., 1−capital-extraction ratio). We observe the tail trend in both chains in the CCDF plot and calculate scaling parameters (α = 2.36 and α = 2.44 on Ethereum and Arbitrum, respectively). This suggests that near-full extraction ratios are part of the observed tail rather than isolated artifacts. [F3] Bilateral extraction frequency. Figure 4 again exhibits the linear log-log CCDF characteristic of a power law, with fitted exponents of α = 2.61 on Ethereum and α = 2.29 on Arbitrum, both within the canonical heavy-tail range. For DCAT, this heavy tail means that recurring transfers between a fixed sender–receiver pair are not anomalous by frequency alone: extractors in the wild routinely revisit the same victim dozens or even hundreds of times, providing cover for repeated DCAT campaigns between a fixed pair of addresses. [F4] Extractee exploitation frequency. The CCDF in Figure 5 is again linear on a log-log scale, with fitted exponents of α = 2.57 on Ethereum and α = 2.16 on Arbitrum. This heavy tail means that wallets repeatedly losing capital are a common feature of DEX trading rather than an anomaly: a DCAT sender that distributes funds to many distinct receivers via repeated staged losses cannot be separated by this feature alone from repeated-loss behavior observed in ordinary DEX activity.

VI. R ANK -BASED A NALYSIS AND C ASE S TUDIES As shown in previous sections, DCAT’s syntactic mimicry prevents definitive attribution from transaction structure alone, while the power-law characteristics of extraction features make fixed-threshold detection brittle. Faced with these combined limitations, we use a rank-based approach to prioritize suspicious incidents for manual review. This section first explains why single-feature ranking is insufficient (§VI-A), then presents a multivariate ranking analysis method (§VI-B), and finally applies the framework to real-world on-chain data through three case studies (§VI-C). Note that, as we rely only on public ledger data, we do not conclusively label these cases as DCAT transfers. To achieve definitive attribution, this statistical foundation would have to be combined with auxiliary information beyond on-chain data. For example, investigators may combine the highest-ranked cases with auxiliary records, such as KYC information or known illicit-address labels, to assess whether a suspicious pattern corresponds to covert value movement.

9

(a) Ethereum

100 10 1 10 2 10 3 10 4 10 5 6 10 10 0 10 1 10 2 10 3 10 4 10 5 10 6

CCDF = Pr(P p) (log scale)

[F1] Extraction 1.000 volume [F2] Extraction 0.210 1.000 ratio [F3] Bilateral -0.047 -0.036 1.000 freq. [F4] Extractee -0.062 -0.035 0.696 1.000 freq. [F1] [F2] [F3] [F4]

1.000 -0.051 1.000 -0.189 -0.005 1.000

Joint survival probability p (log scale, reversed) (a) CCDF of joint survival probability in Ethereum

-0.162 0.019 0.631 1.000 [F1] [F2] [F3] [F4]

(b) Arbitrum

100 10 1 10 2 10 3 10 4 5 10 10 010 1 10 3 10 5 10 7 10 9

Joint survival probability p (log scale, reversed) (b) CCDF of joint survival probability in Arbitrum

Figure 7. CCDF of the joint survival probability p calculated using a survival copula on Ethereum (a) and Arbitrum (b). Smaller p indicates a rarer case.

Figure 6. Kendall τ correlation matrix of the four features on Ethereum (a) and Arbitrum (b).

completely replace per-feature analysis; rather, it serves as a complementary tool that helps analysts grasp the broader context and prioritize manual review.

A. Rank-Based Approach and Feature Dependencies As discussed earlier, the power-law characteristics make it difficult to choose a fixed threshold that categorically separates DCAT incidents from background MEV activity. Consequently, investigators would have to manually inspect suspicious cases by starting with the extreme outliers of each feature. While capable of surfacing extreme anomalies, this single-feature ranking approach leaves analysts with two practical limitations. First, analysts lack a clear method to prioritize among different features when navigating numerous cases. Second, this isolated view may miss incidents that appear ordinary when inspected independently but prove anomalous when two or more features are jointly considered. To understand the relationships between these features, we first measure their pairwise dependence using Kendall’s τ , as depicted in Figure 6. The results demonstrate that the features are neither fully correlated nor completely independent. For example, [F3] bilateral extraction frequency and [F4] extractee exploitation frequency exhibit the strongest dependence on both chains (τ = 0.70 on Ethereum, τ = 0.63 on Arbitrum), as an extractee who is repeatedly victimized tends to be targeted by the same systematic extractor. The relationship between [F1] extraction volume and the remaining three features, however, differs across chains. On Ethereum, [F1] extraction volume correlates more strongly with the [F2] capital-extraction ratio (τ = 0.21) than with the [F3]-[F4] frequency features (τ ≈ −0.05); conversely, on Arbitrum, this pattern reverses, and volume correlates more strongly with the [F3]-[F4] frequency features (τ ≈ −0.19). This partial dependence structure makes a joint analysis informative; that is, an incident exhibiting mild elevation across all four features simultaneously is far rarer in the observed market than its individual feature values suggest. Because most feature pairs are only weakly correlated, such a joint elevation is unlikely to arise naturally. Leveraging this finding, we focus on a multivariate view that examines the joint footprint of an incident across all four features simultaneously. This multivariate approach does not

B. The Multivariate Ranking Analysis Building on these observations, we implement a statistical multivariate ranking analysis that scores each incident by the joint survival probability of its multivariate footprint, by which the incidents are ranked. We first model the joint distribution of baseline extractions using a copula, a statistical tool that captures the dependence structure among multiple variables independently of their individual marginal distributions. Given the variety of copula families (e.g., Gaussian, Clayton, Gumbel), we carefully select the appropriate one to accurately capture the dataset’s underlying dependence structure. Accordingly, we fit a t-copula (ν = 13) to the Ethereum dataset and a Gaussian copula to the Arbitrum dataset; we defer the detailed justification of these choices to Appendix B. After fitting the appropriate copula, we derive the corresponding survival copula Ĉ to rank the incidents based on their joint survival probability p, where a smaller value indicates a rarer joint profile. More formally, for an observed incident with feature values (x1 , . . . , xd ), this joint probability p is calculated using the complementary cumulative distribution function (or survival function): p = Pr(X1 > x1 , . . . , Xd > xd ) = Ĉ(F̄1 (x1 ), . . . , F̄d (xd )), where F̄i (xi ) represents the continuous marginal complementary cumulative distribution function evaluated at the observed value xi of the i-th feature. Consequently, an analyst can prioritize investigations by ranking cases in ascending order of p, focusing manual review efforts on the most statistically improbable events. Results. We apply this analysis to our full dataset of 313,219 Ethereum sandwich incidents and 55,482 Arbitrum arbitrage incidents; revisit §V-B for details. Figure 7 shows the CCDF of the joint survival probability p for both chains. Notably, among the top 500 lowest-p incidents on Ethereum with the lowest p scores, 52% exhibit no individual feature above the 90th percentile; this means that they would likely be missed when observing single features alone, whereas they are surfaced by examining their joint multivariate footprint.

7 Power-law distributions with α ≤ 2 have no finite mean, while those with α ≤ 3 have no finite variance [57].

10

No concurrent deposit for each swap

0x54

X

0x71

...

…

0x7B

0x53

...

0x99

142K USDC

0xDD

...

Figure 8. Case 1. On Arbitrum, extractee 0xDB was arbitraged 1,650 times over two months. In total, 27 extractors captured $43,857, with the top extractor securing $6,250.

…

27 extractors

221K USDC

…

0x97

131K USDC

…

Total 1,650 extractions from our dataset Total extraction volume: $43,857

…

0xDB

6 out of top 7 extraction volume from our dataset Total extraction volume: $693,650

0x26

0x5A

Figure 9. Case 2. Six seemingly independent sandwich extractions occurred within five minutes. The six extractees were funded by the same source, interacted with the same DEX, and extracted by the same extractor, yielding a total extracted revenue of $693,650.

On Arbitrum, the corresponding fraction is zero, indicating that the multivariate approach primarily provides a unified ranking of suspiciousness rather than uncovering entirely new candidates. Notably, the log-log CCDF in Figure 7 again exhibits a straight line, suggesting that the joint survival probability may also exhibit a power-law characteristic. As discussed in the previous section (§V-C), this implies that it is exceedingly challenging to establish a fixed anomaly-detection threshold, making it difficult to deterministically classify extreme outliers as anomalous purely based on their p-values. In other words, the joint survival probability p serves as a continuous ranking metric to prioritize investigations rather than as a strict binary classifier for anomalies.

Several features place this campaign near the extreme tail. The largest single extraction against this address (a profit of $2,569) ranks 14th by volume across our Arbitrum dataset; the highest bilateral frequency from a single extractor (161 times) ranks 18th; and the extractee’s overall exploitation frequency (1,650 times) ranks first among all Arbitrum extractees. The multivariate framework also ranks the headline arbitrage incident involving this extractee as the second most anomalous event on Arbitrum. Manual inspection reveals that 0xDB also executed 32,133 WETH-to-ARB swaps on a single Uniswap pool (0xBF) at intervals of roughly two minutes; in total, this converted 4,591.18 WETH (≈ $7.8M ) into 25,167,463.30 ARB (≈ $7.5M ) between March 12 and May 16, 2025. Two further observations highlight the anomalous nature of this address. First, while the address might initially appear to be a service provider given that the acquired ARB was forwarded to 8,232 distinct recipient addresses in a fan-out pattern, the WETH used for the swaps originated entirely from the extractee itself. If this entity were acting as a legitimate service provider, it should have received funds from external sources concurrently, thereby exhibiting a simultaneous fan-in and fan-out structure. We found no public information linking this address to a known service, leaving it as an unexplained, unilateral token distributor. Second, the address ceased all on-chain activity in May 2025 immediately after its WETH balance was exhausted. Under a single-operator interpretation, this cluster would correspond to a covert transfer of $43,857 during our observation window, possibly alongside a separate swap-and-fan-out flow.

C. Real-world Case Studies We now examine three example cases drawn from the extreme tail of our multivariate analysis. These cases are not intended to establish definitive attribution. Rather, they illustrate how the proposed ranking framework can prioritize incidents that merit deeper investigation using only public on-chain data. Definitive attribution would require auxiliary information, such as case records, exchange records, or known illicit-address labels. Table I summarizes the three case studies and the distinct forensic signal each one illustrates. Case 1 captures systematic repetition in Arbitrum arbitrage, Case 2 captures extreme extraction volume in Ethereum sandwiches, and Case 3 captures a jointly rare Ethereum footprint that is not extreme along any single feature. 1) Case 1: Systematic extraction on Arbitrum: We first present a long-running Arbitrum campaign, shown in Figure 8, that is visible to both per-feature and multivariate ranking. Within our observed dataset (March 1 to April 20, 2025), the extractee 0xDB8 was targeted 1,650 times by 27 distinct extractors, yielding a total extraction volume of $43,857. The most profitable extractor (0x54) accumulated roughly $6,251, and the single largest extraction against this extractee9 netted $2,569 at a 0.30 loss ratio.

2) Case 2: A cluster of large extractions on Ethereum: We next examine six high-value Ethereum sandwich extractions, shown in Figure 9. On March 12, 2025, around 09:00 UTC, the same extractor (0x26) sandwiched six extractees within a four-minute window. The extractor captured approximately $54,446 from 0x5a10 , $82,277 from 0x2b11 , $85,057 from 10 https://etherscan.io/tx/0x937d424f43eeb36ec91651e1c9a48a8d7c9f8a45 7e09375b9e8284743e7ec5e4 11 https://etherscan.io/tx/0xc7bb7130407ac0d5d94b8a9b682ac2c32a9d4292 454eca39b35220d0321c76f9

8 https://arbiscan.io/address/0xdb633ffd9d74afa6782eb753349bb8b4e2b51c

c2 9 https://arbiscan.io/tx/0xf07e8957eab98954ebfcae4f6529129c2a0c182dbbf 519402072fbaf807ef836

11

Table I T HREE SUSPICIOUS MEV CASES SURFACED BY OUR RANK - BASED ANALYSIS ON E THEREUM AND A RBITRUM . No.

Month/Year

Chain, MEV type

Case 1 Case 2 Case 3

Mar.-Apr. 2025 Mar. 2025 May.-Aug. 2025

Arbitrum, arbitrage Ethereum, sandwich Ethereum, sandwich

Inferred transferred value $43.9K $502.8K $2.8K

Main signal

Core investigative clue

Repeated extraction Extreme volume Jointly rare footprint

One extractee, 27 extractors, large fan-out pattern High-ranked incidents share timing, extractor, and funding source Not extreme per-feature, but surfaced by multivariate ranking

3HYh

8 extractors

Funded by a Solana account

0xae

0x5a

0xa8

$127 …

Total 21 extractions from our dataset Total extraction volume: $2,765

…

0x5D12 , $124,576 from 0x9913 , $135,348 from 0xDD14 , and $211,946 from 0x5A15 , yielding $693,650 in total extracted revenue. The captured value was subsequently distributed among the extractor, the block builder, and the proposers.16 These six extractions rank first through fifth, and seventh by volume across our entire Ethereum dataset, ensuring that single-feature ranking flags them immediately. The multivariate framework ranks these same incidents 86th, 157th, 200th, 233rd, 264th, and 349th, respectively. This illustrates a complementary role of the two views: when one feature is already extreme, a single-feature ranking is the primary signal, while the multivariate score provides corroborating context. Further manual inspection of public traces suggest that the six extractees are not independent. Their funds trace back through separate intermediate paths to a common source address (0x53), which routed parallel transfers to each extractee. Two additional observations sharpen this picture. First, the intermediate addresses on each funding path executed swaps with conventional slippage and incurred minimal losses, indicating that the operator is capable of configuring safe slippage tolerances. Second, all six extractees ceased on-chain activity shortly after their respective extractions. Note that this is a rediscovery of a previously reported large extraction case [16], [17], [18], but our case study provides a more comprehensive and systematic analysis of this highly suspicious group of extractions. If a single entity controlled the six extractees, the extractor, and the builder, this cluster would correspond to a net asset movement of $502,752 at a cost of $190,900 paid to the proposers. A benign explanation remains possible, but the timing, common funding source, shared extractor, and postextraction inactivity make this cluster a high-priority candidate for manual review. 3) Case 3: Inconspicuous extractions on Ethereum: Finally, we present a case, depicted in Figure 10, that demonstrates the specific value of multivariate ranking. The multivariate framework ranks a sandwich incident involving

0xc3

Figure 10. Case 3. Extractee 0x5a was sandwiched 21 times by a total of eight extractors, resulting in a total extraction volume of $2,765. Although each individual feature remains within a normal range, the joint probability of this footprint is highly improbable.

extractee 0x5a17 as the 141st most anomalous incident on Ethereum. Across our dataset, 0x5a was sandwiched 21 times by eight distinct extractors, losing a total of $2,765 at an average extraction ratio of 0.02. The most active extractor (0xae) accounted for 12 of these incidents and $1,269 in extracted value. No single feature is individually extreme. The largest extraction volume is $374 (ranked 2,257th), the highest loss ratio is 0.07 (ranked 43,725th), the bilateral frequency is 12 (ranked 2,914th), and the extractee exploitation frequency is 21 (ranked 1,942nd). Thus, a single-feature review would need to inspect more than 1,900 higher-ranked Ethereum incidents before reaching this extractee. The multivariate framework instead places the case 141st overall, making it much more likely to receive manual attention. Further manual inspection reveals a distinctive cross-chain pattern. The extractee was initially funded by a Solana address (3HYh) via a Solana-to-Ethereum bridge. After a period of activity, 0x5a bridged its remaining balance back to the same Solana address and ceased all on-chain operations. If both the extractee and its extractors were controlled by a single DCAT adversary, this campaign would constitute a covert transfer of $2,765 from Solana to Ethereum, executed without any observable on-chain link between the sender and the receiver.

12 https://etherscan.io/tx/0x14b910b4044eb0c64ce080c02e836eec8302f0fc fe3ffc5c757373bfba313845 13 https://etherscan.io/tx/0x636ca7a5f63a6698c82e860e610363e75d971844 03fa06f9907243a84e25b68a 14 https://etherscan.io/tx/0xb403f921671c5f1494153f0b9543a0650ff1212a 4b557f2ea53455107c94215c 15 https://etherscan.io/tx/0xee9fcd2b9996e96b642cb4cda47fc140f98fdaf07e e02657743d4bfcc4670106 16 The extractor received $12,463, $10,684, $11,287, $13,927, $13,444, and $20,090; the builder received $30,152, $42,732, $52,910, $87,173, $76,160, and $131,730; and the proposers received $11,832, $28,861, $20,861, $34,249, $34,972, and $60,125 for the extractions of 0x5a, 0x2b, 0x5D, 0x99, 0xDD, and 0x5A, respectively.

VII. D ISCUSSIONS We discuss two questions related to DCAT: Is DCAT applicable to other economic loss events beyond sandwich and arbitrage extractions? (§VII-A) Can DCAT be possibly eradicated? (§VII-B) 17 https://etherscan.io/address/0x5a7aacccca80cb06d65100c91cd6da1c4d8 7590c

12

background MEV activity. We further showed that semantic inspection has limited separating power due to heavy-tailed MEV behavior, but that multi-feature outlier ranking can still support forensic triage. By extending blockchain untraceability from unlinkability to unobservability, this work adds a new analytical lens to blockchain forensics for reasoning about future covert value-movement cases.

A. Other Possible Economic Loss Events for DCAT Our experiments focus on MEV extractions, but DCAT only requires an on-chain event in which one party appears to lose value and another party can plausibly capture it as ordinary market profit. Several other DeFi mechanisms may therefore provide similar camouflage. • Liquidation. Decentralized lending protocols use liquidation to resolve undercollateralized positions [14], [58]. When the value of a borrower’s collateral falls below a protocoldefined safety threshold, the smart contract liquidates the position by auctioning the collateral at a discounted price to recover the outstanding debt. A DCAT sender could deliberately create an undercollateralized position and allow it to be liquidated, while the receiver wins the liquidation and captures the discounted collateral. • Rug pull. A rug pull commonly involves a project operator creating a trading pair, attracting swaps into a low-value or worthless token, and then withdrawing the valuable liquidity [59]. DCAT can reuse this pattern by having the receiver deploy the trading pair and withdraw liquidity after the sender intentionally swaps the target asset into the pool. The resulting loss appears as participation in a fraudulent or failed market rather than as a direct transfer. These examples are not exhaustive. They suggest that DCAT is best understood as a general way to hide value movement inside ecosystem-native loss events, not as a technique specific to the two MEV settings evaluated in this paper.

Ethical Considerations This work poses minimal ethical risk. All end-to-end DCAT experiments were conducted on public testnets, specifically the Ethereum Hoodi testnet and the Arbitrum Sepolia testnet. Even in these testnet environments, our experiments used only wallets, tokens, and liquidity pools controlled by the authors. Thus, the experiments did not interact with or affect other users, assets, or applications on the testnets. Our real-world analyses rely only on public on-chain data and are used for aggregate measurement and forensic triage, not for definitive attribution of specific entities. R EFERENCES [1] D. Deuber and D. Schröder, “Coinjoin in the wild: An empirical analysis in dash,” in European Symposium on Research in Computer Security. Springer, 2021, pp. 461–480. [2] A. Pertsev, R. Semenov, and R. Storm, “Tornado cash privacy solution version 1.4,” Tornado cash privacy solution version, vol. 1, no. 6, 2019. [3] J. Bonneau, A. Narayanan, A. Miller, J. Clark, J. A. Kroll, and E. W. Felten, “Mixcoin: Anonymity for bitcoin with accountable mixes,” in International conference on financial cryptography and data security. Springer, 2014, pp. 486–504. [4] L. Valenta and B. Rowan, “Blindcoin: Blinded, accountable mixes for bitcoin,” in International Conference on Financial Cryptography and Data Security. Springer, 2015, pp. 112–126. [5] T. Ruffing, P. Moreno-Sanchez, and A. Kate, “Coinshuffle: Practical decentralized coin mixing for bitcoin,” in European symposium on research in computer security. Springer, 2014, pp. 345–364. [6] I. Miers, C. Garman, M. Green, and A. D. Rubin, “Zerocoin: Anonymous distributed e-cash from bitcoin,” in 2013 IEEE symposium on security and privacy. IEEE, 2013, pp. 397–411. [7] E. B. Sasson, A. Chiesa, C. Garman, M. Green, I. Miers, E. Tromer, and M. Virza, “Zerocash: Decentralized anonymous payments from bitcoin,” in 2014 IEEE symposium on security and privacy. IEEE, 2014, pp. 459–474. [8] G. Danezis, C. Fournet, M. Kohlweiss, and B. Parno, “Pinocchio coin: building zerocoin from a succinct pairing-based proof system,” in Proceedings of the First ACM workshop on Language support for privacy-enhancing technologies, 2013, pp. 27–30. [9] C. Garman, M. Green, I. Miers, and A. D. Rubin, “Rational zero: Economic security for zerocoin with everlasting anonymity,” in International Conference on Financial Cryptography and Data Security. Springer, 2014, pp. 140–155. [10] N. Van Saberhagen, “Cryptonote v 2.0,” https://web.getmonero.org/reso urces/research-lab/pubs/cryptonote-whitepaper.pdf, 2013. [11] K. Qin, L. Zhou, and A. Gervais, “Quantifying blockchain extractable value: How dark is the forest?” in 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022, pp. 198–214. [12] P. Daian, S. Goldfeder, T. Kell, Y. Li, X. Zhao, I. Bentov, L. Breidenbach, and A. Juels, “Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability,” in 2020 IEEE symposium on security and privacy (SP). IEEE, 2020, pp. 910–927. [13] R. McLaughlin, C. Kruegel, and G. Vigna, “A large scale study of the ethereum arbitrage ecosystem,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 3295–3312. [14] C. Ferreira Torres, A. Mamuti, B. Weintraub, C. Nita-Rotaru, and S. Shinde, “Rolling in the shadows: Analyzing the extraction of mev across layer-2 rollups,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 2591–2605.

B. Eradicating DCAT Completely eradicating DCAT appears unlikely, unfortunately, without removing the loss events that provide its cover. Prevalent practices such as sandwich extraction and arbitrage, however, are deeply integrated into the structural design and economic incentives of many blockchain ecosystems [45], [11], rendering their complete removal impractical. As long as MEV activities persist in the ecosystem and are considered normal, DCAT can continue to operate by utilizing these events as cover for unobservable transfers. There have been efforts to mitigate MEV extraction through technical means, such as fair ordering protocols [60], [61]. However, no technical mitigation has yet demonstrated the near-complete elimination of MEV extraction. Worse yet, recent work shows that technical mitigations against MEV extraction may be bypassed in some fair-ordering protocols [62]. Overall, we argue that DCAT is more realistically addressed through forensic triage, ecosystem monitoring, and auxiliary investigation than through complete eradication. VIII. C ONCLUSION This paper studied whether staged economic loss events in blockchains can covertly move assets while making the transfer itself unobservable. To our knowledge, this is the first in-depth study showing that this stronger form of untraceability can be instantiated on representative layer-1 and layer2 blockchains through DCAT, which blends transfers into

13

[15] F. Luo, Z. Li, W. Luo, Z. He, X. Luo, Z. Ma, S. Song, and T. Chen, “Light into darkness: Demystifying profit strategies throughout the mev bot lifecycle,” in NDSS, 2026. [16] T. Craig, “Money launderers are mimicking terrible traders to bypass detection, crypto security experts say,” https://www.dlnews.com/artic les/defi/lazarus-sandwich-attacks-its-own-trades-to-launder-crypto/, March 2025, accessed: 2026-05. [17] Cointelegraph, “Crypto trader gets sandwich attacked in stablecoin swap, loses $215k,” https://kr.tradingview.com/news/cointelegraph%3A2a60 2cb81094b%3A0-crypto-trader-gets-sandwich-attacked-in-stablecoinswap-loses-215k/, March 2025, accessed: 2026-05. [18] Crypto Alchemy, “Defi user loses over $700k usdc in a sandwich attack,” https://www.binance.com/en/square/post/21489047210377, March 2025, accessed: 2026-05. [19] Y. Cao, X. Cheng, and Y. Liu, “Peb separation and state migration: Unmasking the new frontiers of defi aml evasion,” arXiv preprint arXiv:2603.26290, 2026. [20] M. Möser, R. Böhme, and D. Breuker, “An inquiry into money laundering tools in the bitcoin ecosystem,” in 2013 APWG eCrime researchers summit. Ieee, 2013, pp. 1–14. [21] K. M. Alonso et al., “Zero to monero,” Zero to monero, 2020. [22] A. Pfitzmann and M. Köhntopp, “Anonymity, unobservability, and pseudonymity—a proposal for terminology,” in Designing Privacy Enhancing Technologies: International Workshop on Design Issues in Anonymity and Unobservability Berkeley, CA, USA, July 25–26, 2000 Proceedings. Springer, 2001, pp. 1–9. [23] Z. Wang, S. Chaliasos, K. Qin, L. Zhou, L. Gao, P. Berrang, B. Livshits, and A. Gervais, “On how zero-knowledge proof blockchain mixers improve, and worsen user privacy,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2022–2032. [24] L. Wu, Y. Hu, Y. Zhou, H. Wang, X. Luo, Z. Wang, F. Zhang, and K. Ren, “Towards understanding and demystifying bitcoin mixing services,” in Proceedings of the Web Conference 2021, 2021, pp. 33–44. [25] A. Turner and A. S. M. Irwin, “Bitcoin transactions: a digital discovery of illicit activity on the blockchain,” Journal of Financial Crime, vol. 25, no. 1, pp. 109–130, 2018. [26] S. Farrugia, J. Ellul, and G. Azzopardi, “Detection of illicit accounts over the ethereum blockchain,” Expert systems with applications, vol. 150, p. 113318, 2020. [27] S. Meiklejohn, M. Pomarole, G. Jordan, K. Levchenko, D. McCoy, G. M. Voelker, and S. Savage, “A fistful of bitcoins: characterizing payments among men with no names,” in Proceedings of the 2013 conference on Internet measurement conference, 2013, pp. 127–140. [28] E. Androulaki, G. O. Karame, M. Roeschlin, T. Scherer, and S. Capkun, “Evaluating user privacy in bitcoin,” in International conference on financial cryptography and data security. Springer, 2013, pp. 34–51. [29] F. Reid and M. Harrigan, “An analysis of anonymity in the bitcoin system,” in Security and privacy in social networks. Springer, 2012, pp. 197–223. [30] D. Ron and A. Shamir, “Quantitative analysis of the full bitcoin transaction graph,” in International conference on financial cryptography and data security. Springer, 2013, pp. 6–24. [31] G. Gomez, P. Moreno-Sanchez, and J. Caballero, “Watch your back: Identifying cybercrime financial relationships in bitcoin through backand-forth exploration,” in Proceedings of the 2022 ACM SIGSAC conference on computer and communications security, 2022, pp. 1291–1305. [32] M. Spagnuolo, F. Maggi, and S. Zanero, “Bitiodine: Extracting intelligence from the bitcoin network,” in International conference on financial cryptography and data security. Springer, 2014, pp. 457–468. [33] K. Lubbertsen, M. van Eeten, and R. van Wegberg, “Ghost clusters: Evaluating attribution of illicit services through cryptocurrency tracing,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 1357–1374. [34] D. Y. Huang, M. M. Aliapoulios, V. G. Li, L. Invernizzi, E. Bursztein, K. McRoberts, J. Levin, K. Levchenko, A. C. Snoeren, and D. McCoy, “Tracking ransomware end-to-end,” in 2018 IEEE Symposium on Security and Privacy (SP). IEEE, 2018, pp. 618–631. [35] K. Liao, Z. Zhao, A. Doupé, and G.-J. Ahn, “Behind closed doors: measurement and analysis of cryptolocker ransoms in bitcoin,” in 2016 APWG symposium on electronic crime research (eCrime). IEEE, 2016, pp. 1–13. [36] G. Kappos, H. Yousaf, R. Stütz, S. Rollet, B. Haslhofer, and S. Meiklejohn, “How to peel a million: Validating and expanding bitcoin clusters,”

in 31st USENIX security symposium (USENIX security 22), 2022, pp. 2207–2223. [37] F. Victor, “Address clustering heuristics for ethereum,” in International conference on financial cryptography and data security. Springer, 2020, pp. 617–633. [38] D. Lin, J. Wu, Y. Yu, Q. Fu, Z. Zheng, and C. Yang, “Denseflow: Spotting cryptocurrency money laundering in ethereum transaction graphs,” in Proceedings of the ACM Web Conference 2024, 2024, pp. 4429–4438. [39] J. Wu, D. Lin, Q. Fu, S. Yang, T. Chen, Z. Zheng, and B. Song, “Toward understanding asset flows in crypto money laundering through the lenses of ethereum heists,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 1994–2009, 2023. [40] Z. Wu, J. Liu, J. Wu, Z. Zheng, and T. Chen, “Tracer: Scalable graphbased transaction tracing for account-based blockchain trading systems,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 2609–2621, 2023. [41] U. D. of the Treasury, “U.s. treasury sanctions notorious virtual currency mixer tornado cash,” https://home.treasury.gov/news/press-releases/jy0 916, 2022. [42] S. P. Lee, “Market share of decentralized crypto exchanges, by trading volume,” https://www.coingecko.com/research/publications/decentralize d-crypto-exchanges-market-share/, 2026, accessed: 2026-04. [43] TokenTerminal, “Uniswap monthly active users,” https://tokentermina l.com/explorer/projects/uniswap/metrics/user-mau/, 2026, accessed: 2026-04. [44] Dune, “Ethereum uniswap v2 pools tvl,” https://dune.com/queries/690 4458?utm source=share&utm medium=copy&utm campaign=query, 2026, accessed: 2026-04. [45] Ethereum, “Proposer-builder separation,” https://ethereum.org/roadmap /pbs/, accessed: 2026-05. [46] Flashbots, “Github repository of rbuilder,” https://github.com/flashbots /rbuilder, accessed: 2025-11. [47] ——, “Flashbots boost relay - hoodi,” https://boost-relay-hoodi.flashbo ts.net/, accessed: 2025-11. [48] S. Prime, “Github repository of lighthouse,” https://github.com/sigp/li ghthouse, accessed: 2025-11. [49] Paradigm, “Github repository of reth,” https://github.com/paradigmxyz /reth, accessed: 2025-11. [50] Flashbots, “Github repository of mev-boost,” https://github.com/flashbo ts/mev-boost, accessed: 2025-11. [51] Uniswap, “Github repository of uniswap v2-core,” https://github.com/U niswap/v2-core, accessed: 2025-11. [52] Flashbots, “Github repository of mev-inspect-py,” https://github.com/fla shbots/mev-inspect-py, accessed: 2025-11. [53] L. Zhou, K. Qin, C. F. Torres, D. V. Le, and A. Gervais, “High-frequency trading on decentralized on-chain exchanges,” in 2021 IEEE symposium on security and privacy (SP). IEEE, 2021, pp. 428–445. [54] C. Ferreira Torres, A. Mamuti, B. Weintraub, C. Nita-Rotaru, and S. Shinde, “Github of rolling in the shadows,” https://github.com/c hristoftorres/Rolling-in-the-Shadows, 2024, accessed: 2025-11. [55] CoinGecko, “Coingecko,” https://www.coingecko.com/, accessed: 202511. [56] A. Clauset, C. R. Shalizi, and M. E. Newman, “Power-law distributions in empirical data,” SIAM review, vol. 51, no. 4, pp. 661–703, 2009. [57] M. E. Newman, “Power laws, pareto distributions and zipf’s law,” Contemporary physics, vol. 46, no. 5, pp. 323–351, 2005. [58] K. Qin, L. Zhou, P. Gamito, P. Jovanovic, and A. Gervais, “An empirical study of defi liquidations: Incentives, risks, and instabilities,” in Proceedings of the 21st ACM internet measurement conference, 2021, pp. 336–350. [59] F. Cernera, M. La Morgia, A. Mei, and F. Sassi, “Token spammers, rug pulls, and sniper bots: An analysis of the ecosystem of tokens in ethereum and in the binance smart chain (bnb),” in 32nd USENIX security symposium (USENIX security 23), 2023, pp. 3349–3366. [60] M. Kelkar, S. Deb, S. Long, A. Juels, and S. Kannan, “Themis: Fast, strong order-fairness in byzantine consensus,” in Proceedings of the 2023 acm sigsac conference on computer and communications security, 2023, pp. 475–489. [61] K. Mu, B. Yin, A. Asheralieva, and X. Wei, “Separation is good: A faster order-fairness byzantine consensus,” in Proc. NDSS, 2024, pp. 1–17. [62] E. Park, T. Yoon, H. Nam, D. Maram, and M. S. Kang, “On frontrunning risks in batch-order fair systems for blockchains,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, 2025, pp. 918–932.

14

As discussed in a previous section (§IV-C), executing DCAT on Arbitrum requires the adversary to place the rate-inflating and arbitrage transactions in separate blocks to mimic an honest arbitrageur, yet execute them as closely as possible to preempt competing arbitrageurs. In the remainder of this appendix, we detail how the adversary precisely times its submissions in distinct blocks and reliably outcompetes these rival bots.

100

Success Rate (%)

A PPENDIX A O PERATIONAL D ETAILS OF A RBITRAGE - BASED DCAT ON A RBITRUM

80 60 40 20 0 270 280 290 300 310 320 330 340 350

Arbitrage transaction submission delay (milliseconds)

A. Timing Transaction Submissions

Figure 11. Relationship between success rate and submission gap by threshold

To mimic an honest arbitrageur’s behavior, the adversary should submit the transactions in separate blocks by delaying the arbitrage transaction submissions. To understand how fast an honest arbitrageur can react to a rate-inflating transaction, we analyze the timing constraints of the Arbitrum network environment. The Arbitrum sequencer imposes a 200 ms processing delay on every submitted transaction and then publishes the transaction by including it in the nearest block, which is generated every 250 ms. Consequently, the minimum time for a submitted transaction to be published is greater than 200 ms (e.g., 201 ms), assuming the transaction waits 200 ms in the sequencer and is published as the final transaction in a block. In other words, if an honest arbitrageur reacts instantly upon observing a rate-inflating transaction in block i, their subsequent arbitrage transaction requires some time to process, making it most likely to land in block i + 2 or later. Understanding this timing constraint, we formulate a strategy to reliably orchestrate DCAT transactions by submitting them in separate blocks while keeping the submission delay for the arbitrage transaction as small as possible. The primary challenge lies in estimating the precise block boundary to accurately time both transaction submissions and minimize the delay between the transactions. To estimate the block boundaries, we periodically sent probe transactions from an AWS instance in North Virginia and confirmed their final positions within the generated blocks. Once a probe is confirmed as the final transaction in a block, the adversary calculates the exact submission time for the rate-inflating transaction by adding a target delay (n × 250 ms, where n represents the number of future blocks) to the probe’s sending time. This precise timing allows the rate-inflating transaction to also land as the final transaction of its respective block. Following this submission, the adversary waits for a delay that is larger than the minimum reaction time for any honest observer (e.g., 201 ms) before submitting the corresponding arbitrage transaction. We empirically evaluated various delays and present the results in Figure 11. For each delay, we conducted 200 trials and measured the success rate of placing the second transaction exactly two blocks after the first. Our results demonstrate that a delay of 330 ms achieves a 98.3% success rate, and this is the delay we used to demonstrate DCAT in the network.

B. Competition Against Other Arbitrageurs Having established a reliable method for deniable transaction placement, we now evaluate the adversary’s ability to outcompete rival arbitrageurs. Because our testnet experiments relied on custom tokens, natural arbitrage competition does not exist; thus, we implemented our own competing arbitrage bot to simulate real-world conditions. The competing bot employed an aggressive monitoring strategy: it continuously parsed new blocks for arbitrage opportunities and immediately submitted transactions upon detecting a profitable state. To maximize their competitiveness, we deployed the bot on AWS instances in Ohio, optimally co-locating them with the testnet sequencer. This 100% success rate stems from an inherent asymmetric advantage: the adversary knows the exact timestamp of the rate-inflating transaction submission, whereas competing bots must opportunistically detect the event only after the block is published. A PPENDIX B J USTIFICATION ON C OPULA FAMILY S ELECTION As previously discussed, we assign each incident a joint survival probability using a copula to rank the incidents (§VI). This appendix briefly discusses the pipeline for calculating this joint survival probability and justifies the selection of copula families. A. Feature Transformation A copula model requires each feature to be expressed as a uniform score in (0, 1); raw values cannot be used directly because the four features span incompatible scales and types. We therefore apply an empirical CDF transform to each feature independently, mapping every observation to its percentile rank within the dataset. Because the two frequency features are highly discrete (e.g., 60–75% of incidents share the value 1), they are not suitable to calculate the copula. To address this, we randomly add small jitters to tie-break to achieve continuous uniform margins. We repeated this process over multiple jitter seeds to confirm that the tie-breaking process has a negligible impact on the final results. The resulting uniform scores are then mapped to normal scores via the probit transform for copula fitting.

15

B. Copula Family Selection With the transformed features in hand, we select the copula family that best captures the dependency structure of each dataset. There are several copula families, each capturing a different dependence structure, and choosing the appropriate one is essential for accurate joint probability estimation. We evaluate four candidate families (Gaussian, Clayton, Gumbel, and Frank) using tail dependence plots, Kendall’s τ , and AIC/BIC comparisons. Our evaluation reveals that the Clayton, Gumbel, and Frank copulas are unsuitable for our dataset. Specifically, the standard 4-dimensional Clayton and Gumbel require positive dependence across all pairs, a condition violated by four of the six feature pairs on both chains; and the standard one-parameter Frank copula cannot capture the heterogeneous pairwise dependence structure observed across the four features. While the Gaussian copula is the only candidate capable of handling the full dependency structure within a single coherent 4-dimensional model, we must further evaluate its goodness-of-fit for each specific dataset. Ethereum. The Gaussian copula fits poorly on the Ethereum dataset: only 57% of the bulk distribution falls within 10% of its theoretical reference. This poor fit is caused by strong upper tail dependence between the two frequency features (λ̂U (0.95) = 0.715), a characteristic that the Gaussian copula structurally cannot capture. We therefore fit a t-copula, which extends the Gaussian copula with a single degrees-of-freedom parameter ν to control tail heaviness. This approach yields a substantial improvement of ∆AIC = −13,397 over the Gaussian model at the optimal ν = 13. Arbitrum. The Gaussian copula achieves the best AIC among all valid models for Arbitrum, exhibiting moderate tail dependence across most pairs (λ̂U (0.95) = 0.216 for the strongest pair). This confirms that the Gaussian copula is the appropriate choice for modeling the Arbitrum baseline. C. Validation Having selected the copula family for each chain, we confirm that the fitted models correctly describe their respective datasets. To this end, we compare the empirical distance scores against their theoretical reference distributions using QQ plots. Specifically, we use a χ-squared distribution (χ2 (4)) for the Gaussian copula and an F-distribution (F (4, ν)) for the t-copula. Ethereum. The t-copula demonstrates a strong fit, capturing 85.4% of the 5th–95th percentile bulk within 10% of the diagonal, with deviation beginning only at the 99.2nd percentile. For comparison, the Gaussian copula captures only 57% of the bulk and begins deviating at the 94.6th percentile. This contrast confirms that the t-copula is better suited for the Ethereum dataset. Arbitrum. The Gaussian copula captures 85.3% of the bulk within 10% of the diagonal, with deviation beginning at the 96.2nd percentile. This outcome confirms that the Gaussian model provides a good fit for Arbitrum.

16