Key Takeaways

An eclipse attack isolates a single node in a peer-to-peer (P2P) network from the rest of the honest network by surrounding it with attacker-controlled nodes.

Once isolated, the victim node can be fed false data, which may allow attackers to facilitate double spends, manipulate transaction confirmations, or reduce mining competition.

Eclipse attacks target the connection layer of a blockchain, not the protocol itself, making them a network-level threat rather than a consensus failure.

Countermeasures include restricting incoming connections, whitelisting trusted peers, and protocol updates that randomize peer selection.

Introduction

An eclipse attack is a network-level attack on a blockchain node. The attacker floods the victim with connections from nodes they control, replacing all of the victim's honest peers. The term "eclipse" refers to the way the attacker blocks the node's view of the real network, similar to how a solar eclipse blocks sunlight.

Unlike a Sybil attack, which tries to gain influence over the entire network by creating many fake identities, an eclipse attack focuses on a single target. The goal is not to take over the network, but to manipulate what one specific node sees and believes.

This article explains how eclipse attacks work, what attackers can do once a node is isolated, and what defenses are available.

How an Eclipse Attack Works

Bitcoin and other blockchain networks rely on nodes staying synchronized with each other. Each full node stores a copy of the blockchain and communicates with a set of peers. Due to bandwidth and software limits, the Bitcoin client caps connections at 125 peers by default. A node can only observe the network through those connections.

An attacker exploits this by flooding a target node with connection requests from IP addresses they control. Over time, particularly after a node restarts, the attacker attempts to ensure all of the node's peer slots are occupied by malicious nodes. The target continues operating normally from its own perspective, but every piece of data it sends or receives passes through attacker-controlled nodes.

Executing this attack typically requires the attacker to control a large number of IP addresses or run many proof-of-work (PoW) nodes, which requires resources. Research on Ethereum has shown that eclipse attacks can also be combined with topology-based deanonymization techniques, making them a concern beyond just Bitcoin.

Consequences of an Eclipse Attack

Isolating a node opens the door to several follow-on attacks. The attacker's goal is usually financial gain or a competitive advantage in mining.

0-confirmation double spends

Some merchants and services accept transactions before they are confirmed in a block. An attacker who has eclipsed such a merchant can broadcast a payment to the merchant through the malicious nodes while sending a conflicting transaction to the real network. The merchant's node sees the payment and accepts it, but the double spend on the actual network means the payment to the merchant may never confirm.

N-confirmation double spends

Even when a merchant waits for multiple block confirmations, an eclipsed node can be deceived. The attacker feeds the victim a private fork of the blockchain, which makes the node believe transactions have been confirmed when they have not. Once the victim releases goods or services, the attacker abandons the private fork and the real network's chain takes over.

Weakening competing miners

An eclipsed mining node wastes computational resources mining on a chain that the rest of the network will not accept. This effectively removes the eclipsed miner's hash rate from the competition. By eclipsing enough miners, an attacker can lower the threshold needed to execute a 51% attack. For example, if 40% of the total hash rate belongs to nodes that have been eclipsed, the attacker needs to acquire only slightly more than half of the remaining 60% rather than the full network hash rate.

Eclipse Attack Mitigations

Protocol developers have introduced several defenses against eclipse attacks. Bitcoin Core, for example, limits incoming connections and randomizes the peer selection process to make it harder for an attacker to fill all peer slots. The consensus algorithm itself is not changed, but the connection management layer is made more resilient.

Node operators can take additional steps to reduce their exposure. Blocking unsolicited incoming connections and manually specifying trusted peer addresses helps ensure a node maintains at least some connections to honest peers. Running nodes on diverse IP ranges also makes it harder for a single attacker to eclipse a connection.

These mitigations come with trade-offs. A fully closed node that only connects to pre-approved peers is harder to eclipse but cannot contribute to network propagation or onboard new participants. Protocol-level improvements aim to balance openness with resistance to manipulation.

FAQ

What is the difference between an eclipse attack and a Sybil attack?

A Sybil attack creates many fake identities to gain influence over the network as a whole. An eclipse attack focuses on one target node, surrounding it with attacker-controlled peers to cut off its view of the honest network. Eclipse attacks are more targeted and require fewer resources than a broad Sybil attack.

Do eclipse attacks affect all blockchains?

Any blockchain that relies on peer-to-peer networking and has limits on the number of peer connections a node can maintain may be vulnerable to eclipse attacks. Research has identified eclipse attack vectors on both Bitcoin and Ethereum, though both networks have implemented mitigations over time.

How can a node detect if it has been eclipsed?

Detection is difficult because an eclipsed node appears to function normally. Signs may include unusual delays in receiving new blocks, discrepancies in reported transaction confirmations, or a node syncing to a chain that differs from trusted external block explorers. Running multiple nodes across different IP addresses and cross-checking their views of the blockchain can help.

Has an eclipse attack ever been executed on Bitcoin?

There are no widely documented cases of a successful eclipse attack causing major financial damage on Bitcoin or other major networks. This is partly because the attack requires significant resources and partly because protocol improvements have raised the difficulty of executing one. The theoretical risk remains, but practical defenses have kept the threat limited as of 2026.

Closing Thoughts

Eclipse attacks highlight a class of vulnerabilities that exist at the network layer rather than within the blockchain protocol itself. They require real resources to execute and are most dangerous when combined with other attack vectors, such as double spends or hash rate manipulation. Protocol improvements and careful node configuration can substantially reduce the risk. As with most security considerations in blockchain systems, awareness and ongoing protocol development are key defenses.

Further Reading

Peer-to-Peer Networks Explained

Double Spending Explained

What Is a 51% Attack?

Sybil Attacks Explained

What Is Proof of Work (PoW)?

Disclaimer: This content is presented to you on an "as is" basis for general information and educational purposes only, without representation or warranty of any kind. It should not be construed as financial, legal, or other professional advice, nor is it intended to recommend the purchase of any specific product or service. You should seek your own advice from appropriate professional advisors. Where the content is contributed by a third-party contributor, please note that those views expressed belong to the third-party contributor, and do not necessarily reflect those of Binance Academy. Digital asset prices can be volatile. The value of your investment may go down or up and you may not get back the amount invested. You are solely responsible for your investment decisions and Binance Academy is not liable for any losses you may incur. For more information, see our Terms of Use, Risk Warning and Binance Academy Terms.