# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 4 Anomalies and Anomaly Detection in Blockchain
### Anomalies in Blockchain Networks
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Anomaly** & **Description** & **Occurrence** \\ \hline \multirow{4}{*}{Ransomwares} & Encryption of victim’s data, rendering it inaccessible until a ransom is paid (it poses a significant threat to individuals and organizations, causing data loss or financial harm). & Their occurrence has increased, with cryptocurrencies often serving as the preferred method of payment due to their pseudonymous nature (it is expected to cost the global economy billions of dollars annually by 2025 [96]). & They are a constant threat to cryptocurrency exchanges and blockchain networks as they can disrupt services, causing financial losses, e.g., in 2023, several exchanges experienced DDoS attacks, leading to temporary outages. & They have occurred in various blockchain networks, including Ethereum. While not as common as other attacks, they constitute a concern for network security [90]. \\ \hline \multirow{4}{*}{Eclipse Attacks} & Isolation of a victim’s node by surrounding it with malicious nodes, controlling the victim’s network connections, and potentially manipulating or censoring their transactions. & They have been witnessed in several smaller cryptocurrencies. The most notable example is the 51\% attack on Ethereum Classic in 2019, resulting in millions of dollars in double-spending [97]. \\ \hline \multirow{4}{*}{51\% Attacks} & Secret mining on top of withholding blocks, gaining an unfair advantage over honest miners in the race to add blocks to the blockchain. & They are rarely observed in practice due to their complexity (however, they remain a topic of academic research and discussion in the cryptocurrency community [98]). \\ \hline \multirow{4}{*}{Brute Force Attacks} & Systematic combinations of all possible passwords or encryption keys until the correct one is discovered, typically through an exhaustive trial-and-error approach. & While successful, they are relatively rare due to the strength of modern encryption algorithms, but they can still occur, especially if users employ weak passwords. \\ \hline \multirow{4}{*}{Finney Attacks} & Special type of double-spending attacks, where an attacker pre-mines a valid transaction but keeps it private while mining a new block to confirm the pre-mined transaction, excluding it from the network & Rarely observed due to their intricate nature, but when occurred, they underscore the importance of robust network security measures [99]. \\ \hline \multirow{4}{*}{Fork After Withholding Attacks} & Successful mining of a new block without broadcasting it to the network (instead, the miner continues mining on top of the withheld block privately, aiming to gain an advantage over other miners by producing a longer chain). & They have occurred in smaller blockchain networks, where miners attempt to gain a competitive advantage by secretly mining blocks (while not as common as other attacks, they highlight the vulnerabilities inherent in proof-of-work consensus mechanisms). \\ \hline \multirow{2}{*}{Deanonymization Attacks} & Invole linking IP addresses with cryptocurrency wallets compromising user privacy and security & Although they have not been reported often, they have become increasingly sophisticated [100]. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._negative ones. The concise labels to the left of each bar provide a clear description of the corresponding impact. In 2014, an attack executed in the Ethereum blockchain called Man-in-the-Middle hijacked BGP routes within a Canadian autonomous system, resulting in the theft of USD 83,000 [102]. This incident highlighted the vulnerability of blockchain networks to attacks that aim at stealing digital assets. This attack exploited communication delays to manipulate transactions and blocks within the blockchain network, potentially leading to double-spending-based financial losses for legitimate users.