Deanonymizing Monero Transactions in Tor Network

• URL: http://arxiv.org/abs/2607.07062v1
• Date: Wed, 08 Jul 2026 06:40:01 GMT
• Title: Deanonymizing Monero Transactions in Tor Network
• Abstract summary: Monero is a privacy-focused cryptocurrency that incorporates anonymity networks (such as Tor and I2P) to prevent malicious attackers from linking transactions with their source IPs.<n>We propose textit ProxyMark, a three-stage deanonymization framework for the Monero Tor network, comprising node role identification, originated transaction identification, and node location deanonymization.
• Score: 2.588505906526794
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Monero is a privacy-focused cryptocurrency that deploys the Dandelion++ protocol and incorporates anonymity networks (such as Tor and I2P) to prevent malicious attackers from linking transactions with their source IPs. In this paper, we demonstrate that Monero's integration of the Tor network introduces a fundamental vulnerability: a Monero Tor node's originated transactions are exclusively forwarded to two outgoing Tor hidden service nodes (proxy nodes) prior to clearnet propagation, enabling an adversary to capture originated transactions by occupying the target node's outgoing connections. Based on this observation, we propose \textit{ProxyMark}, a three-stage deanonymization framework for the Monero Tor network, comprising node role identification, originated transaction identification, and node location deanonymization. Through experiments on the live Tor network, Monero mainnet, and testnet, we empirically demonstrate the effectiveness of \textit{ProxyMark} in successfully deanonymizing transactions originating from Monero nodes over Tor.

Related papers

• Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network! [34.18933219306657]
  Eclipse attacks isolate a blockchain node by monopolizing its network connections.<n>We present the first attacks tailored to unreachable nodes in Monero's P2P network.<n>Our results show that unreachable nodes can be reliably driven into stable, long-lived eclipse states.
  arXiv  Detail & Related papers  (2026-09-09T14:43:56Z)
• Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions [47.65093774088672]
  This survey and tutorial article reviews the literature over the period 1980--2026 on the evolution from classical multi-agent systems to open agent networks.<n>We first review this evolution and show how the trust boundary expands from individual execution to cross-agent, cross-platform, and cross-organizational interaction.<n>We develop a five-dimensional taxonomy covering entity and capability trust, authorization and delegation trust, information and trust, coordination and group-robustness trust, and accountability and settlement trust.
  arXiv  Detail & Related papers  (2026-08-05T09:32:35Z)
• Techreport: Evaluating Tor-based Location Privacy for Ethereum Validators [0.10499611180329803]
  Privacy and anonymity of validators, especially regarding IP address linkability, are essential to protect the network from various attacks.<n>Correlating the IP addresses of validators with their identities can be exploited by attackers to cause network delays, MEV exploitation, and finality risks.<n>We evaluate a Tor-based protocol named Tor push that helps unlink IDs from their nodes' IP addresses.
  arXiv  Detail & Related papers  (2026-05-27T21:50:17Z)
• ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking [34.15634406550005]
  Low-latency anonymity networks such as Tor remain vulnerable to infrastructure-level traffic analysis.<n>We introduce NATA, a non-invasive active traffic-correlation analysis algorithm.<n>It injects distinguishable throughput patterns into traffic flows through controlled bandwidth perturbations.
  arXiv  Detail & Related papers  (2026-05-07T08:57:57Z)
• ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems [56.613157564882925]
  Malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions.<n>Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats.<n>We propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions.
  arXiv  Detail & Related papers  (2026-04-06T05:15:00Z)
• AetherWeave: Sybil-Resistant Robust Peer Discovery with Stake [3.9189409002585553]
  We present AetherWeave, a stake-backed peer-discovery protocol that ties network participation to deposited stake.<n>We prove that, with high probability, either the honest overlay remains connected or a $(ssqrtn)$-fraction of nodes in every smaller component raise an attack-detection flag.<n>AetherWeave is the first peer-discovery protocol to simultaneously provide Sybil resistance and privacy.
  arXiv  Detail & Related papers  (2026-03-24T23:50:17Z)
• Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models [62.87838888016534]
  Graph Foundation Models (GFMs) are pre-trained on diverse source domains and adapted to unseen targets.<n>Backdoor attacks against GFMs are non-trivial due to three key challenges.<n>We propose GFM-BA, a novel Backdoor Attack model against Graph Foundation Models.
  arXiv  Detail & Related papers  (2025-11-22T08:52:09Z)
• ART: A Graph-based Framework for Investigating Illicit Activity in Monero via Address-Ring-Transaction Structures [0.9869634509510014]
  We propose a case study in which we leverage a novel graph-based methodology to extract structural and temporal patterns from Monero transactions.<n>This represents a first partial step toward developing analytical tools that support investigative efforts in privacy-preserving blockchain ecosystems.
  arXiv  Detail & Related papers  (2025-11-20T09:59:50Z)
• Time Tells All: Deanonymization of Blockchain RPC Users with Zero Transaction Fee (Extended Version) [29.846192259039455]
  We propose a novel deanonymization attack that can link an IP address of a RPC user to this user's blockchain pseudonym.<n>By monitoring network traffic and analyzing public ledgers, the attacker can link the IP address of the TCP packet to the pseudonym of the transaction initiator.<n>Our attack achieves a high success rate of over 95% against normal RPC users on various blockchain networks.
  arXiv  Detail & Related papers  (2025-08-29T09:08:16Z)
• ChamaleoNet: Programmable Passive Probe for Enhanced Visibility on Erroneous Traffic [48.87214752144106]
  ChamaleoNet transforms any production network into a transparent monitor to let administrators collect unsolicited and erroneous traffic directed to hosts.<n>ChamaleoNet is programmed to ignore well-formed traffic and collect only erroneous packets.<n>Simple analytics unveil internal and infected hosts, identify temporary failures, and enhance visibility on external radiation produced by attackers looking for vulnerable services.
  arXiv  Detail & Related papers  (2025-08-17T20:54:41Z)
• Privacy Preserving Semi-Decentralized Mean Estimation over Intermittently-Connected Networks [59.43433767253956]
  We consider the problem of privately estimating the mean of vectors distributed across different nodes of an unreliable wireless network. In a semi-decentralized setup, nodes can collaborate with their neighbors to compute a local consensus, which they relay to a central server. We study the tradeoff between collaborative relaying and privacy leakage due to the data sharing among nodes.
  arXiv  Detail & Related papers  (2024-06-06T06:12:15Z)
• Distinguishing Tor From Other Encrypted Network Traffic Through Character Analysis [0.0]
  The Tor network provides a free and widely used anonymization service for everyone. There are different approaches to distinguishing Tor from non-Tor encrypted network traffic. We have examined to what extent the number of encryptions contributes to being able to distinguish Tor from non-Tor encrypted data traffic.
  arXiv  Detail & Related papers  (2024-05-15T15:07:31Z)
• Collaborative Deanonymization [0.0]
  We propose protocols to resolve the tension between anonymity and accountability in a peer-to-peer manner. We illustrate how the protocols could apply to Monero rings and CoinJoin transactions in Bitcoin.
  arXiv  Detail & Related papers  (2020-05-07T15:03:19Z)
• AN-GCN: An Anonymous Graph Convolutional Network Defense Against Edge-Perturbing Attack [53.06334363586119]
  Recent studies have revealed the vulnerability of graph convolutional networks (GCNs) to edge-perturbing attacks. We first generalize the formulation of edge-perturbing attacks and strictly prove the vulnerability of GCNs to such attacks in node classification tasks. Following this, an anonymous graph convolutional network, named AN-GCN, is proposed to counter edge-perturbing attacks.
  arXiv  Detail & Related papers  (2020-05-06T08:15:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.