Extracting and Verifying Illicit Bitcoin Addresses from Underground Forum Discussions

Abstract

Existing labeled Bitcoin datasets are largely derived from community-reported abuse, blockchain heuristics, incident-specific collections, or proprietary labeling processes. Their construction methods are rarely publicly reproducible and often provide limited evidence that an address was directly involved in illicit activity. We present a reproducible pipeline for constructing evidence-backed Bitcoin labels from HackForums, an underground cybercrime forum with fifteen years of archived activity. The pipeline combines LLM-assisted screening, expert review, and on-chain validation to identify Bitcoin addresses explicitly associated with illicit transactions discussed on the forum. Each released label is supported by contextual evidence from underground discussions and validated on-chain. The resulting dataset contains 2,438 manually verified illicit Bitcoin addresses spanning 2010-2024 and twelve cybercrime categories assigned during LLM screening. We release the dataset, temporal metadata, and the complete extraction pipeline to support reproducible research on cryptocurrency-facilitated cybercrime.