SLIDE 1 operators: 1 01 3,042 IPv4 Reachable Full Bitcoin Nodes 1 operator Joe Antek · BTCHEL 2026 SLIDE 2 IP and ASN assumptions are wrong operators: 1 02 Experiment economics: speaker-supplied estimates. Twelve subnets supplied by the operator. 12 × /24 · 3 ASNs · No /16 in common bitprojects 1 operator 45.40.98.0 /24 66.163.223.0 /24 89.106.27.0 /24 103.47.56.0 /24 103.246.186.0 /24 123.100.246.0 /24 173.46.87.0 /24 174.140.231.0 /24 184.174.95.0 /24 203.11.72.0 /24 206.206.109.0 /24 216.107.135.0 /24 RENT /24 $120–150 /month BUY /24 ~$7K Resellable asset SLIDE 3 A single entity can hide in plain sight 45.40.0.0/16 45.40.98.0/24 66.163.0.0/16 66.163.223.0/24 89.106.0.0/16 89.106.27.0/24 103.47.0.0/16 103.47.56.0/24 103.246.0.0/16 103.246.186.0/24 123.100.0.0/16 123.100.246.0/24 173.46.0.0/16 173.46.87.0/24 174.140.0.0/16 174.140.231.0/24 184.174.0.0/16 184.174.95.0/24 203.11.0.0/16 203.11.72.0/24 206.206.0.0/16 206.206.109.0/24 216.107.0.0/16 216.107.135.0/24 12 × /24 · 0 shared /16 boundary AS12029 AS29798 AS401199 3 ASNs used (5 available) Proxy services = even more distributed 03 operators: 1 SLIDE 4 Cost assumptions are wrong $2–3K /month Operating cost 6× Dell R740 512GB each · refurbished ~$2,500 each · hardware purchase operators: 1 04 Photo and cost estimates: Joe Antek SLIDE 5 3,042 endpoints in half a rack operators: 1 05 Architecture and counts: Joe Antek. Dots are endpoints; server symbols are full node instances. 1 operator 36 full node instances Proxmox · LXC ZFS dedup + linked clones HAProxy inbound Dante + HAProxy outbound seeding policy routing AS12029 /24 /24 /24 /24 AS29798 /24 /24 /24 /24 AS401199 /24 /24 /24 /24 36 instances · 12 × /24 · 3 ASNs · No /16 in common SLIDE 6 The network found me operators: 1 06 Bitcoin Core IRC, 4 Dec 2025; BNOC threads 40 and 45. Full supplied IRC messages in companion file. #bitcoin-core-dev · 04 Dec 2025 JUN 2025 Investigation 17 OCT 2025 User agent 21 OCT 2025 +2,040 IPs 04 DEC 2025 Core IRC 19 MAR 2026 BIP 110 signal LATE MAR 2026 Public attention jonatack: yes, he does seem quite confused about how all of this work, but i must hand it to him that i expected us to be more robust than that and his mainnet experiment demonstrated it to me I think this guy could cause some damage if he withheld blocks, even if only for 10 minutes... Definitely SLIDE 7 End of the experiment March 31, 2026 · 00:12 UTC 80,526 → 0 inbound connections Inbound on b10c’s monitors 00:12 00:12 operators: 1 07 Charts: b10c monitoring hosts, BNOC #108. Left: outbound to bitprojects. Right: inbound per host. SLIDE 8 What to do RUN NODES CONNECT TO HONEST NODES USE A BEACON Run nodes. Make them listening on IPv4, Tor, and I2P. Public reachability is the attack surface — and the defense. Always have a connection to at least one honest node. Increase outbound connections from 12 to 48-64 (contentious — believed the network can't handle this) Also connect via Tor and I2P for network diversity Some method of a beacon that tests for connections to the same node/entity appearing as multiple different IPs/endpoints Reach out if you want my help. bitprojects.io 08 operators: 1 SLIDE 9 operators: 1 SLIDE 10 operators: 1 SLIDE 11 operators: 1 SLIDE 12 operators: 1 SLIDE 13 operators: 1 SLIDE 14 operators: 1 SLIDE 15 operators: 1 SLIDE 16 operators: 1 SLIDE 17 operators: 1 SLIDE 18 operators: 1 SLIDE 19 operators: 1 SLIDE 20 operators: 1 SLIDE 21 operators: 1 SLIDE 22 operators: 1 SLIDE 23 operators: 1 SLIDE 24 operators: 1 SLIDE 25 operators: 1 SLIDE 26 operators: 1 SLIDE 27 operators: 1 SLIDE 28 operators: 1