Eclipse Attack

Blockchain nodes discover peers through a gossip protocol and maintain a limited number of connections (Bitcoin defaults to 8 outbound, 125 total). In an eclipse attack, the adversary floods the victim's peer table with attacker-controlled IP addresses, eventually monopolizing all connections. The victim thinks it is connected to the real network but only sees what the attacker allows.

A 2015 research paper by Heilman et al. from Boston University demonstrated that eclipsing a Bitcoin node was achievable with as few as a few hundred IP addresses and modest resources. The attack exploits the peer selection and eviction mechanisms — by repeatedly connecting and disconnecting, the attacker can fill the victim's tried and new tables with malicious addresses.

Once eclipsed, the victim can be shown a forked chain (enabling double-spend attacks against that specific node), delayed in receiving new blocks (stealing mining revenue), or censored from seeing specific transactions. According to the research, merchants running their own nodes are particularly vulnerable — an attacker could double-spend against an eclipsed merchant node that does not see the conflicting transaction.

Bitcoin and Ethereum have implemented mitigations: anchor connections (persistent connections to trusted peers), diverse peer sourcing, outbound connection restrictions, and peer rotation limits. Running multiple nodes with diverse network configurations further reduces eclipse attack risk. The attack highlights why node decentralization and network diversity are critical security properties.