BITCOIN NETWORK RESEARCH / 2024—2026

3,042 nodes.
One operator.

Bitcoin counts reachable nodes.
But who’s on the other end?

A two-year experiment exposing the gap between IP diversity and operator diversity in Bitcoin’s peer-to-peer network.

Explore the findings Get the slides

Joe Antek / BTC Helsinki 2026

3,042 endpoint dots. All controlled by one operator.Illustrative topology

EXPERIMENT CONCLUDED 31 MAR 2026SCROLL TO INVESTIGATE

IPv4 reachable endpoints: 3,04201
Actual full node instances: 3602
Clearnet reachable nodes ↗: ~30%03
Independent operator: 104

01 / THE ASSUMPTIONoperators: 1

An IP address
isn’t an identity.

Different IPs. Different subnets. Different autonomous systems. On the surface, a diverse set of Bitcoin peers.

Behind them, one person. The experiment tested a simple assumption: that diversity in network addresses translates into diversity in control.

IP diversity≠operator diversityTHE CORE FINDING

12 × /24

Distinct IPv4 subnets

3 ASNs

AS12029 · AS29798 · AS401199

0 shared /16

Separate address-group boundaries

ASMAP groups addresses by autonomous system. It does not establish who operates the peers.

12 Inspect the advertised subnets

Historical experiment addresses. Each /24 sits inside a different /16.

45.40.98.0/24103.47.56.0/24173.46.87.0/24206.206.109.0/2489.106.27.0/24174.140.231.0/24184.174.95.0/24216.107.135.0/2466.163.223.0/24103.246.186.0/24123.100.246.0/24203.11.72.0/24

Download subnet list

02 / THE EXPERIMENToperators: 1

Thousands of endpoints.
Half a rack.

Built with refurbished hardware and a familiar infrastructure stack. Thirty-six full node instances served 3,042 public endpoints.

Joe Antek’s rack of Dell PowerEdge servers with network cables and six visible R740 units — **6 × Dell R740**512 GB RAM each · refurbishedPhoto: Joe Antek

THE COST OF LOOKING DECENTRALIZED

$2–3K/ month

Reported operating cost. One person running the entire operation.

~$2,500per server, upfront

8 rented / 4 ownedIPv4 /24 blocks

HOW IT WAS CONNECTED1 operator

3,042 public endpoints12 × /24 · 3 ASNs

INBOUNDHAProxy

OUTBOUND SEEDINGDante + HAProxy

↕ policy routing ↕

36 full node instancesProxmox · LXC · ZFS dedup + linked clones

Architecture and cost estimates: Joe Antek. Hardware purchases and owned IP blocks are capital assets, separate from monthly operating cost.

03 / THE EVIDENCEoperators: 1

Thousands of connections.
The same other end.

The network treated the endpoints as separate peers. The connection data exposed how concentrated those relationships could become.

Inbound connections: 80,526
Unique source IPs: 35,127
Source IPs with 8+ connections: 653
Peak outbound traffic: 5,475 Mbps

Operator-reported measurements. The 80,526 / 35,127 connection snapshot is dated 30 March 2026.

MANY PEERS. ONE COUNTERPARTY.

Eight connections.
Zero operator diversity.

653 source IPs had at least eight connections to this infrastructure. Joe reported intervals when some peers’ outbound connections all reached his nodes.

Connection counts alone do not establish a complete eclipse: one source IP can represent multiple nodes, and other connection types may exist.

Download reported metrics

Connection dashboard showing 80,526 inbound connections, 35,127 source IPs, 3,042 destination IPs, 12 subnets, zero shared /16s, and 3 ASNs — Inbound TCP/8333 · 30 March 2026FROM THE PRESENTATION

Of all clearnet reachable nodes, according to Bitcoin Core developer darosior’s December 2025 estimate. Reachability was measurable. Independent ownership was not.Read the original discussion

04 / THE DISCOVERYoperators: 1

The network
found me.

Researchers were investigating in 2025. BIP 110 signalling brought wider public attention in March 2026. Community observation made the common operator visible.

Mid-2024
The experiment begins
One /24. A question about peer identity.
June 2025
Initial investigation
darosior investigates misbehaving nodes.
17 October 2025
A recognizable user agent
instagibbs spots “dont-spam-me-bro” nodes.
21 October 2025
+2,040 reachable IPs
Network monitors record the expansion.
04 December 2025
Bitcoin Core IRC discussion
Peer selection and eclipse resistance.
19 March 2026
BIP 110 signalling
Followed by wider public attention in late March.

#bitcoin-core-dev2025-12-04

// A discussion about outbound peer selection

16:56:41<darosior>
jonatack: yes, he does seem quite confused about how all of this work, but i must hand it to him that i expected us to be more robust than that and his mainnet experiment demonstrated it to me

16:58:59<eugenesiegel>
I think this guy could cause some damage if he withheld blocks, even if only for 10 minutes...

16:59:06<darosior>
Definitely

Read darosior’s background message

<darosior>
Some background for this is that this summer i looked into an entity that was spinning up a large number of fake nodes (see https://antoinep.com/posts/misbehaving_nodes/). I and a few others are now in discussion with the guy running this operation. He has since then scaled up and now controls 3000 reachable nodes, which is about 30% of all clearnet reachable nodes. As a result when you spin up a new nodes nowadays it would most of the time have around 3 outbound connections to this guy. We've had multiple reports of this happening. So all this to say my concern is not purely theoretical, there is an entity actively trying to demonstrate it, which is reasonably successful so far. This is discussed at b10c's https://bnoc.xyz/ forum. See https://bnoc.xyz/t/increase-in-the-number-of-reachable-ipv4-nodes-bitprojects-io/45/9 and https://bnoc.xyz/t/satoshi-29-1-0-dont-spam-me-bro-nodes/40/18

Timeline: BTC Helsinki presentation. Initial investigation ↗ · BNOC monitoring thread ↗

05 / THE SHUTDOWNoperators: 1

End of the experiment.
Not the question.

The infrastructure went offline on 31 March 2026.
Thousands of peers had to find a different other end.

EXPERIMENT OFFLINE31 MAR 2026
00:12 UTC

80,5260

Reported inbound connections → experiment offline

b10c’s chart showing outbound connections from monitoring nodes to bitprojects disappearing around 00:12 UTC — 01
**Connections to bitprojects disappear**Outbound connections from b10c’s monitoring hosts.

Monitoring chart showing an increase in inbound peers per host immediately after the bitprojects shutdown — 02
**The rest of the network reconnects**Inbound connections on b10c’s monitoring hosts.

b10c reported approximately 220 additional IPv4 peers across his monitors after the shutdown.

Read the shutdown observations

06 / WHAT TO DOoperators: you?

Decentralization takes
more than counting nodes.

The goal: always have a connection to at least one honest node.
These are directions for stronger peer diversity and further research.

RUN NODES

Be an independent
part of the network.

Run publicly listening nodes. Make them reachable on IPv4, Tor, and I2P. More independently operated peers give the network more real choices.

PUBLIC REACHABILITY MATTERS

CONNECT TO HONEST NODES

Know at least one
of your peers.

Maintain a connection to an independently operated, honest node. Add Tor and I2P connections for network diversity, and look beyond IP counts when assessing your peers.

DIVERSIFY WHO, AS WELL AS HOW

USE A BEACON

Test independence.
Keep watching.

Develop in-band probes that help detect when different endpoints lead to the same node or entity. A beacon is a research proposal for ongoing measurement.

OBSERVATION IS A CONTINUING JOB

AN OPEN QUESTION

48–64 outbound connections?

Joe proposes increasing outbound connections from 12 to 48–64. The capacity cost and effects on the network graph need evaluation; a higher count alone does not guarantee independent peers.

Follow the discussion

07 / KEEP THE CONVERSATION GOINGoperators: 1

JOE ANTEK / BITPROJECTS

Let’s make Bitcoin
harder to fool.

Independent research. Real infrastructure. Public findings.
Available for publicly disclosed research and engineering engagements.

Contact Joe on BNOC

QR code linking to https://bitprojects.io — **bitprojects.io**THE PROJECT. THE FINDINGS.

01BTC Helsinki 2026 presentationPPTX / 15.2 MB 02Reported experiment metricsCSV 03The 12 advertised subnetsCSV 04Extracted presentation textTXT

Explore all 24 original presentation images

Original files extracted without modification. Appendix captures reflect different observation times; their counts may differ from the reported summary.

Server rack photograph SLIDE 04 / image.jpeg

Shutdown: outbound to bitprojects SLIDE 07 / image.png

Shutdown: inbound on monitors SLIDE 07 / image2.png

Project QR code SLIDE 08 / image3.png