Polskie Forum Bitcoin

Hijacking Bitcoin: Routing Attacks on Cryptocurrencies

Bitcoin hosting centralization makes it vulnerable to routing attacks

Although one can run a Bitcoin node anywhere on earth, the nodes that compose the network today are far from being spread uniformly around the globe.
Particularity, our results indicate that most of the Bitcoin nodes are hosted in few Internet Service providers (ISPs): 13 ISPs (0.026% of all ISPs) host 30% of the entire Bitcoin network (left graph).
Moreover, most of the traffic exchanged between Bitcoin nodes traverse few ISPs. Indeed, our results indicate that 60% of all possible Bitcoin connections cross 3 ISPs. In other words, 3 ISPs can see 60% of all Bitcoin traffic (right graph).
Together, these two characteristics make it relatively easy for a malicious ISP to intercept a lot of Bitcoin traffic.

Attack#1: Routing attacks can partition Bitcoin into pieces

An attacker can use routing attacks to partition the network into two (or more) disjoint components. By preventing nodes within a component to communicate with nodes outside of it, the attacker forces the creation of parallel blockchains. After the attack stops, all blocks mined within the smaller component will be discarded together with all included transactions and the miners revenue.