Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!

• URL: http://arxiv.org/abs/2609.10260v1
• Date: Wed, 09 Sep 2026 14:43:56 GMT
• Title: Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!
• Abstract summary: Eclipse attacks isolate a blockchain node by monopolizing its network connections.<n>We present the first attacks tailored to unreachable nodes in Monero's P2P network.<n>Our results show that unreachable nodes can be reliably driven into stable, long-lived eclipse states.
• Score: 34.18933219306657
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Eclipse attacks isolate a blockchain node by monopolizing its network connections. Existing attacks on Monero (NDSS'25), Bitcoin (USENIX'15/21, S&P'20) and Ethereum (WWW'26) implicitly assume that the adversary can establish inbound connections, thereby excluding a large and practically dominant class of nodes: \textit{unreachable nodes} operating behind NATs. Such nodes are widely believed to enjoy stronger networks. We challenge this assumption and show that unreachability does NOT imply the expected resilience! We present the first eclipse attacks tailored to unreachable nodes in Monero's P2P network. Our attacks require no inbound access to the victim. Instead, they first poison the peerlist of reachable nodes, which subsequently act as propagation relays to contaminate unreachable nodes' whitelists. The adversary then exploits Monero's built-in outbound connection refresh logic to evict benign neighbors and eventually monopolize all outbound connections. We instantiate this strategy in two attacks: Nyx, which targets long-running unreachable nodes and achieves a complete and persistent eclipse through network-wide poisoning; and Moros, a stealthier attack that exploits the bootstrapping phase to rapidly eclipse newly joined unreachable nodes. We ethically evaluate both attacks. Nyx is validated via large-scale simulations on a Monero network constructed using the SEED Emulator, while Moros is demonstrated on the Monero mainnet against controlled targets. Our results show that unreachable nodes can be reliably driven into stable, long-lived eclipse states. We also propose countermeasures.

Related papers

• Deanonymizing Monero Transactions in Tor Network [2.588505906526794]
  Monero is a privacy-focused cryptocurrency that incorporates anonymity networks (such as Tor and I2P) to prevent malicious attackers from linking transactions with their source IPs.<n>We propose textit ProxyMark, a three-stage deanonymization framework for the Monero Tor network, comprising node role identification, originated transaction identification, and node location deanonymization.
  arXiv  Detail & Related papers  (2026-07-08T06:40:01Z)
• AetherWeave: Sybil-Resistant Robust Peer Discovery with Stake [3.9189409002585553]
  We present AetherWeave, a stake-backed peer-discovery protocol that ties network participation to deposited stake.<n>We prove that, with high probability, either the honest overlay remains connected or a $(ssqrtn)$-fraction of nodes in every smaller component raise an attack-detection flag.<n>AetherWeave is the first peer-discovery protocol to simultaneously provide Sybil resistance and privacy.
  arXiv  Detail & Related papers  (2026-03-24T23:50:17Z)
• Eclipse Attacks on Ethereum's Peer-to-Peer Network [27.463594785520367]
  We present the first end-to-end implementation of an eclipse attack targeting execution-layer nodes.<n>Our attack exploits the bootstrapping and peer management logic to fully isolate a node upon restart.<n>Our DNS list poisoning is the first in the cryptocurrency context and requires only 28 IP addresses over 100 days.
  arXiv  Detail & Related papers  (2026-01-23T09:00:51Z)
• Attack-in-the-Chain: Bootstrapping Large Language Models for Attacks Against Black-box Neural Ranking Models [111.58315434849047]
  We introduce a novel ranking attack framework named Attack-in-the-Chain.<n>It tracks interactions between large language models (LLMs) and Neural ranking models (NRMs) based on chain-of-thought.<n> Empirical results on two web search benchmarks show the effectiveness of our method.
  arXiv  Detail & Related papers  (2024-12-25T04:03:09Z)
• Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending against Poisoning Attacks [53.972077392749185]
  Recent studies have revealed the vulnerability of graph neural networks (GNNs) to adversarial poisoning attacks on node classification tasks.<n>Here we introduce Grimm, the first plug-and-play defense model.
  arXiv  Detail & Related papers  (2024-12-11T17:17:02Z)
• Initial Evidence of Elevated Reconnaissance Attacks Against Nodes in P2P Overlay Networks [0.9003384937161055]
  We investigate the state of active reconnaissance attacks on P2P network nodes by deploying a series of honeypots alongside actual nodes across globally distributed vantage points.<n>We find that nodes experience not only increased attacks, but also specific types of attacks targeting particular ports and services.
  arXiv  Detail & Related papers  (2024-11-21T22:56:16Z)
• Blockchain Amplification Attack [13.13413794919346]
  We show that an attacker can amplify network traffic at modified nodes by a factor of 3,600, and cause economic damages of approximately 13,800 times the amount needed to carry out the attack.<n>Despite these risks, aggressive latency reduction may still be profitable enough for various providers to justify the existence of modified nodes.
  arXiv  Detail & Related papers  (2024-08-02T18:06:33Z)
• Link Stealing Attacks Against Inductive Graph Neural Networks [60.931106032824275]
  A graph neural network (GNN) is a type of neural network that is specifically designed to process graph-structured data. Previous work has shown that transductive GNNs are vulnerable to a series of privacy attacks. This paper conducts a comprehensive privacy analysis of inductive GNNs through the lens of link stealing attacks.
  arXiv  Detail & Related papers  (2024-05-09T14:03:52Z)
• Minimum Topology Attacks for Graph Neural Networks [70.17791814425148]
  Graph Neural Networks (GNNs) have received significant attention for their robustness to adversarial topology attacks. We propose a new type of topology attack, named minimum-budget topology attack, aiming to adaptively find the minimum perturbation sufficient for a successful attack on each node.
  arXiv  Detail & Related papers  (2024-03-05T07:29:12Z)
• Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience [50.460555688927826]
  We propose the Graph Agent Network (GAgN) to address the vulnerabilities of graph neural networks (GNNs)<n>GAgN is a graph-structured agent network in which each node is designed as an 1-hop-view agent.<n>Agents' limited view prevents malicious messages from propagating globally in GAgN, thereby resisting global-optimization-based secondary attacks.
  arXiv  Detail & Related papers  (2023-06-12T07:27:31Z)
• AN-GCN: An Anonymous Graph Convolutional Network Defense Against Edge-Perturbing Attack [53.06334363586119]
  Recent studies have revealed the vulnerability of graph convolutional networks (GCNs) to edge-perturbing attacks. We first generalize the formulation of edge-perturbing attacks and strictly prove the vulnerability of GCNs to such attacks in node classification tasks. Following this, an anonymous graph convolutional network, named AN-GCN, is proposed to counter edge-perturbing attacks.
  arXiv  Detail & Related papers  (2020-05-06T08:15:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.