Eclipse Attack

An eclipse attack isolates a single node on a peer-to-peer network by monopolizing all of its connections, so the victim sees only data the attacker chooses to show it. Unlike a Sybil attack on the whole network, an eclipse attack targets one participant, feeding it a false view of the blockchain while the real network moves on without it.

Why it matters

An eclipsed node can be seriously misled. An attacker can hide new transactions and blocks, trick a merchant into accepting a payment that the real network never confirmed, waste a miner's hash power on a stale chain, or split a victim's view ahead of a double spend attempt. Research published in 2015 by Heilman, Kendler, Zohar, and Goldberg showed practical eclipse attacks against Bitcoin's peer selection logic and prompted concrete fixes.

Bitcoin Core now makes eclipsing far harder: nodes maintain diverse outbound connections, currently around 10 including block-relay-only peers, select peers across different network groups, and protect long-standing addresses in their tables. Running a node behind multiple network paths raises the bar further.

How it works

The attacker floods the victim's address database with attacker-controlled IP addresses, then waits for or forces a restart. On reboot, the node draws its peers from the poisoned table and may connect only to the attacker's machines. Success requires controlling many addresses across different networks, which is costly but not impossible, so defenses focus on diversifying whom a node talks to.