Open supply bitcoin (BTC) developer Timo P — additionally recognized by the pseudonym 0xB10C — lately printed a weblog put up highlighting the actions of an unidentified entity named LinkingLion.
The entity has been connecting to bitcoin nodes and listening to transaction bulletins since 2018, doubtlessly permitting it to hyperlink transactions to IP addresses. It has additionally been lively on the Monero community utilizing the identical IP deal with ranges.
In accordance with 0xB10C, LinkingLion is suspected to be a blockchain evaluation firm accumulating knowledge to enhance its merchandise. The entity makes use of IP addresses from three IPv4 /24 ranges and one IPv6 /32 vary, all of that are introduced by server co-location and internet hosting firm LionLink Networks.
A spooky bitcoin eavesdropper
The conduct of LinkingLion includes establishing TCP connections to bitcoin nodes, sending model messages with obscure person brokers and utilizing 0 because the nonce for all connections. The entity is noticed to have a block peak that lags behind the community’s finest peak, with two completely different configurations recognized as lagging by about 700 and 2100 blocks.
Its peak is estimated to have matched the community’s peak in late This autumn 2022 or early Q1 2023 for the connections lagging by about 700 blocks, and in Q3 2022 for connections lagging by 2100 blocks.
LinkingLion has been noticed opening short-lived connections and shutting them with out sending a verack message, indicating that it might be checking if nodes are reachable on given addresses. The entity learns metadata, such because the model and peak of the blockchain, from nodes.
It responds to messages after the handshake however by no means initiates them and doesn’t request blocks or transactions.
Moreover, LinkingLion has been flooding bitcoin community nodes with a whole bunch of connections per minute, resulting in the eviction of current connections to make room for brand new ones. The entity has additionally been noticed opening connections to nodes on the Monero community.
The character and goal of LinkingLion’s actions stay unclear, however the entity could also be utilizing VPN companies to cover its true location and id.
Quick-term prevention measures embrace manually banning the IP deal with ranges utilized by the entity from making inbound connections to nodes. A banlist has been printed for this goal; nonetheless, this banlist is optionally available and centralized.
0xB10C’s findings underscore the necessity for adjustments to the preliminary transaction broadcast and transaction rebroadcast logic on the bitcoin community and in Bitcoin Core. Attainable options embrace implementing Dandelion or broadcasting transactions over privateness networks similar to Tor.
Whereas banning or reporting the entity’s conduct could function a short-term repair, deeper adjustments to the P2P logic in bitcoin are essential to deal with the foundation downside.
Dandelion is a privacy-enhancement proposal designed to enhance transaction confidentiality inside the bitcoin community.
The core idea includes a two-phase propagation course of: throughout the preliminary “stem section,” transactions are relayed serially from one node to a different, adopted by a “fluff section” the place transactions are broadcasted from one node to all of its friends.
This distinctive propagation sample successfully conceals the originating node of a transaction, making it tougher to hyperlink transactions to particular IP addresses.
To additional improve privateness, nodes collaborating within the stem section can make use of encryption strategies, similar to Tor or v2 P2P transport, to safe their Bitcoin protocol visitors. In abstract, Dandelion affords a strong answer for sustaining transaction privateness and mitigating the danger of exposing customers’ identities on the Bitcoin community.