Underground forums are used to discuss and organise cybercrime (as well as more conventional social activities). These forums are also commonly used for exchanging various digital currencies, either gained through the profits of crime or through less controversial means. Understanding the link between discussions of illicit behaviour and currency exchange can provide insights to identify money laundering and other parts of the cybercrime supply chain. In this paper we use natural language processing to classify posts from HackForums by crime type over a period of more than 10 years. To the best of our knowledge, this is the first time that this type of classification has been used for this large forum dataset. Although the majority of conversations in the forum were identified as relating to non-criminal discussions, we concentrate on the types of crimes being discussed by those exchanging currencies. We find the most popular topics are related to trading credentials and bots and malware. PayPal was one of the most widely advertised digital currencies and we observe significant displacement from Liberty Reserve to Bitcoin after the former was taken down in 2013. Rather than an explicit 'cashing out' mechanism, in which cryptocurrencies gained through crime flow into state-backed fiat currencies, we instead see a circulation of capital between different forms, as cash is held and then cashed back and forward according to movements in the wider currency market. We continue our examination of discussions of cryptocurrencies and explore how the underground market has reacted to new opportunities, with a qualitative case study about Facebook's putative 'Diem' coin. We find that while most discussions are related to the technical details and potential investment opportunities, some potential cybercrime use-cases are raised.

This paper investigates the evolution of investment scam lures and scam-related keywords in the cryptocurrency online forum Bitcointalk over a period of 12 years. Our findings show a shift in scam-related keywords found within posts in the forum, where "Ponzi" was the most popular and most frequently mentioned in 2014 and 2018 and "HYIP" appeared more often in 2018 and 2021. We also identify that the financial principle is the

Researchers analyze underground forums to study abuse and cybercrime activities. Due to the size of the forums and the domain expertise required to identify criminal discussions, most approaches employ supervised machine learning techniques to automatically classify the posts of interest.[Goal] Human annotation is costly. How to select samples to annotate that account for the structure of the forum? [Method] We present a methodology to generate stratified samples based on information about the centrality properties of the population and evaluate classifier performance. [Result] We observe that by employing a sample obtained from a uniform distribution of the post degree centrality metric, we maintain the same level of precision but significantly increase the recall (+30%) compared to a sample whose distribution is respecting the population stratification. We find that classifiers trained with similar samples disagree on the classification of criminal activities up to 33% of the time when deployed on the entire forum.