Eclipse attack

Nodes learn about new blocks and transactions from the peers they connect to. If an attacker manages to occupy every one of a victim node's connections, typically by flooding its address table with attacker-controlled IPs and waiting for or forcing a restart, the node is eclipsed: it only sees what the attacker chooses to relay.

An eclipsed node can be shown a chain with fewer blocks, kept unaware of transactions, or used to confirm a payment that the real network never accepts, which enables double-spending against merchants or exchanges. Miners or validators who are eclipsed waste work on a stale chain. A 2015 academic paper demonstrated practical eclipse attacks on Bitcoin, and Bitcoin Core added countermeasures such as more diverse outbound connections and anchor peers that persist across restarts; other networks have studied similar issues.

The attack targets individual nodes, not the whole network, and requires many IP addresses or control of network infrastructure. It is related to a sybil attack, which creates many fake identities, but its aim is isolation. Running a node with diverse peers and waiting for several confirmations on large payments are the practical defences.