bitprojects.
All slides

3,042 IPv4 Reachable Full Bitcoin Nodes

3,042 dots, one for each IPv4 endpoint, all controlled by one operator.

1

operator

Joe Antek · BTCHEL 2026

skilled retard

3,042 IPv4 endpoints · 36 full node instances · 1 operator

Explore the presentation
01operators: 1

the project

~2 years

A project to demonstrate greater, easier, cheaper susceptibility to Sybil and Eclipse attacks than previously determined.

Easier IP access

IP addresses are easier to acquire than assumed.

Lower attack costs

Attack infrastructure is much cheaper than assumed.

Dispersed appearance

One entity can span unrelated IP ranges and multiple ASNs.

SYBIL ATTACK?

One entity uses many identities to appear as independent peers and gain influence.

ECLIPSE ATTACK?

An attacker controls all of a node’s peers, isolating it from the honest network.

02operators: 1

the timeline

  1. JUL 2024

    First single /24

  2. OCT 2024

    “prove it”

  3. DEC 2024

    +3 × /24

  4. MAR 2025

    “prove it”

  5. MAY 2025

    +8 × /24

  6. 04 DEC 2025

    Core IRC

  7. 19 MAR 2026

    BIP 110 signal

  8. LATE MAR 2026

    Public attention

  9. 31 MAR 2026

    Full node shutdown

#bitcoin-core-dev · 04 Dec 2025

<darosior> jonatack: yes, he does seem quite confused about how all of this work, but i must hand it to him that i expected us to be more robust than that and his mainnet experiment demonstrated it to me

<eugenesiegel> I think this guy could cause some damage if he withheld blocks, even if only for 10 minutes...

<darosior> Definitely

03operators: 1

the gear

Monthly operating cost

~$3k / month

~3.6m sats/month

Gear purchase (one-time)

6× Dell R740

512GB each · refurbished

~$2.5k each · ~3m sats each

2× Arista 7280SR2 switches

$4k each · ~4.8m sats each

The refurbished Dell R740 servers and network switches in the bitprojects rack.
04operators: 1

the addresses

45.40.98.0/24

66.163.223.0/24

89.106.27.0/24

103.47.56.0/24

103.246.186.0/24

123.100.246.0/24

bitprojects

1 operator

173.46.87.0/24

174.140.231.0/24

184.174.95.0/24

203.11.72.0/24

206.206.109.0/24

216.107.135.0/24

RENT

/24

$120–150

~143k–178k sats

/month

BUY

/24

$5k

~5.9m sats

(Resellable asset)

12 × /24 · 3 ASNs · No /16 in common

05operators: 1

the appearance

45.40.0.0/16

45.40.98.0/24

66.163.0.0/16

66.163.223.0/24

89.106.0.0/16

89.106.27.0/24

103.47.0.0/16

103.47.56.0/24

103.246.0.0/16

103.246.186.0/24

123.100.0.0/16

123.100.246.0/24

173.46.0.0/16

173.46.87.0/24

174.140.0.0/16

174.140.231.0/24

184.174.0.0/16

184.174.95.0/24

203.11.0.0/16

203.11.72.0/24

206.206.0.0/16

206.206.109.0/24

216.107.0.0/16

216.107.135.0/24

12 × /24 · 0 shared /16 boundary

AS12029 AS29798 AS401199

3 ASNs used (5 available)

Proxy services = even more distributed

06operators: 1

the stack

1 operator

36

full node instances

Proxmox · LXC

ZFS STORAGE

Deduplication + linked clones

inbound

HAProxy

PORT-BASED POLICY ROUTING

HAProxy

Dante

proxy

outbound seeding

AS12029

/24

/24

/24

/24

AS29798

/24

/24

/24

/24

AS401199

/24

/24

/24

/24

36 instances · 12 × /24 · 3 ASNs · No /16 in common

07operators: 1

the peak

8 December 2025

8 December 2025 terminal snapshot: 113,615 inbound connections, 35,695 unique source IPs, and 1,051 source IPs with 12 or more connections.

113,615

inbound connections

35,695

unique source IPs

1,051

source IPs with 12+ connections to my nodes

Potential eclipse attacks if no honest peer connections remain.

08operators: 1

the shutdown

March 31, 2026 · 00:12 UTC

80,526 → 0

inbound connections

Outbound connections to bitprojects from monitoring nodes fall to zero at the shutdown.
00:12

Inbound on b10c’s monitors

Inbound connections per host on b10c’s monitoring nodes rise after the shutdown.
00:12
09operators: 1

the mitigation strategies

01

Run more real full nodes

02

Connection capacity and counts

1 Listen on IPv4

Make your node reachable on the public Internet. On your router, forward TCP 8333 (or 9333 on some systems) to your Bitcoin node.

2 Raise outbound defaults

32 48 64

Once the network has capacity. (Contentious proposal)

03

Connection paths and types

Increase odds of at least one connection to an honest node.

Use both Tor and I2P. Diversity can improve the odds.

Use ASMap data

Helps enforce connection spread across ASNs. Imperfect, but helps mitigate less sophisticated attacks.

04

Attack detection suggestions

Ideas only. I’m not a developer.

Some type of beacon to probe for same-node connectivity across multiple addresses.

1 Fake address announcements via addr relay

Uses a ~10-minute freshness check. No one-hop limit. A return within seconds may suggest the same node (hypothesis to test).

2 New one-hop beacon protocol

10operators: 1

thank you

X @joeantek joe@bitprojects.io
11operators: 1

supporting images

Slides 12–31

Inbound TCP/8333 connection dashboard: 78,962 connections, 34,502 source IPs, and a table of source IP connection thresholds.
12Inbound TCP/8333 · source IP thresholds

operators: 1

30 March 2026 connection snapshot: 80,526 inbound connections, 35,127 source IPs, 3,042 destination IPs, 12 subnets, zero shared /16s, and 3 ASNs.
13Inbound TCP/8333 · 30 March 2026

80,526 inbound connections · 35,127 unique source IPs

operators: 1

Full-height view of the bitprojects server rack, including the servers, switches, and cabling.
14The server rack

operators: 1

Akvorado Sankey diagram of Bitcoin TCP/8333 traffic through transit providers, countries, and destination autonomous systems.
15Traffic paths · Sankey

operators: 1

Akvorado stacked traffic chart with a breakdown by destination country and transit provider.
16Traffic by destination and transit

operators: 1

Akvorado outbound traffic chart with a selected peak and a total traffic series.
17Outbound traffic

operators: 1

Historical node counts by autonomous system, from October 2024 through November 2025.
18Node counts by autonomous system

operators: 1

Akvorado traffic chart with a stacked breakdown of traffic series and a central spike.
19Traffic distribution

operators: 1

Akvorado stacked traffic chart and table showing the selected traffic breakdown.
20Traffic distribution

operators: 1

Akvorado stacked traffic measurements with a short spike and the corresponding breakdown table.
21Traffic distribution

operators: 1

Akvorado aggregate traffic time series.
22Aggregate traffic

operators: 1

Akvorado traffic time series with a detailed table of the contributing traffic series.
23Traffic breakdown

operators: 1

Akvorado stacked traffic chart with an extended breakdown table.
24Traffic breakdown

operators: 1

Akvorado traffic chart with a selected spike, tooltip, and detailed breakdown.
25Traffic spike · detailed breakdown

operators: 1

Akvorado stacked traffic chart showing a short traffic spike.
26Traffic spike

operators: 1

Akvorado Sankey diagram showing traffic paths with a highlighted link.
27Traffic paths · Sankey

operators: 1

Akvorado Sankey diagram with a selected downstream traffic path.
28Traffic paths · Sankey

operators: 1

Terminal connection snapshot: 102,681 inbound connections, 25,099 unique source IPs, and counts by connection threshold.
29Inbound TCP/8333 · 102,681 connections

operators: 1

Terminal connection snapshot: 84,751 inbound connections, 20,783 unique source IPs, and counts by connection threshold.
30Inbound TCP/8333 · 84,751 connections

operators: 1

Terminal connection snapshot: 90,106 inbound connections, 23,257 unique source IPs, and counts by connection threshold.
31Inbound TCP/8333 · 90,106 connections

operators: 1

Open original