DNS Seed Node Hijacking and Sybil Attacks

Attacker controls a DNS seed and returns only malicious peer addresses, eclipsing the victim's node from the honest P2P network.

Node operators relying on default seed configuration; wallet users transacting through eclipsed nodes.

Complete network isolation enables transaction confirmation withholding, balance poisoning, and linkage of all transactions to the victim's IP address.

Hardcode trusted peer lists; disable DNS seeding via --no-dns; verify seed node operator reputation and infrastructure security.

Attacker deploys thousands of Sybil nodes that aggressively advertise themselves to fill the victim's peer tables, crowding out honest connections.

All Monero node operators, particularly those with long-running or high-value wallets.

Eclipse attack success probability increases with Sybil count; attacker can observe all transaction propagation and infer the true spend in ring signatures via timing analysis.

Use --out-peers and --in-peers to limit connection counts; maintain long-lived connections to known honest nodes; monitor peer churn rates.

Attacker hijacks the IP prefix of a DNS seed server via BGP manipulation, redirecting DNS queries to a malicious resolver under their control.

All nodes performing DNS lookups for seed addresses during the attack window.

Transparent hijack of peer discovery; victim nodes receive no indication that returned addresses are malicious. Enables mass eclipse of nodes in a targeted geographic region.

Use DNSSEC validation where supported; maintain a local cache of previously resolved peer addresses; cross-reference seed responses against known-good peer lists.

Attacker injects forged DNS responses into a recursive resolver's cache, causing it to return attacker-controlled IP addresses for seed node queries.

Node operators using shared or ISP-provided recursive resolvers without DNSSEC validation.

Silent redirection of peer discovery; all nodes behind the poisoned resolver receive malicious peer lists until the cache entry expires or is flushed.

Run a local validating resolver; enforce DNSSEC; monitor for unexpected changes in connected peer IP ranges.

After eclipsing a node, the attacker logs the exact time a transaction is first relayed by the victim and correlates it with network-wide propagation to identify the true input.

Wallet users transacting through an eclipsed node; exchanges and merchants processing withdrawals.

Probabilistic deanonymization of ring signatures; the first relayed transaction is highly likely to be the true spend, breaking Monero's privacy guarantees for that output.

Use Dandelion++ stem-phase correctly; avoid transacting immediately after node restart; run a node with diverse, long-lived peer connections.

Eclipsed node is fed a forked chain or stale tip, causing wallet balances to reflect incorrect state and transactions to be built on an invalid chain.

Exchange hot wallets; custodians; any user relying on the eclipsed node for balance queries.

Double-spend risk if the victim constructs transactions on a stale chain; denial of service for deposits and withdrawals; incorrect balance reporting.

Cross-reference block height and hash against public block explorers or multiple independent nodes; configure --enforce-dns-checkpointing.

A legitimate seed node operator's infrastructure is compromised, allowing an attacker to modify the peer list served by that seed without the operator's knowledge.

All nodes that resolve peers through the compromised seed.

Trusted infrastructure becomes a malicious peer source; difficult to detect because the seed domain and IP remain unchanged.

Diversify seed sources; do not rely on a single seed operator; monitor for anomalous peer behavior such as all peers sharing the same ASN or /24 subnet.

Attacker controls DNS seed responses, returning only malicious peer IPs to bootstrapping nodes

Node operators, wallet users, exchanges

High

Hardcode trusted peer lists; use multiple independent seed sources; verify peer diversity post-sync

Attacker operates thousands of Sybil nodes to dominate peer tables and eclipse a target node

High-value wallet users, custodians, privacy-sensitive operators

Critical

Increase outbound connection count; use anchor connections to known peers; monitor for anomalous peer churn

Attacker isolates a node and floods it with fake transactions to observe which ones propagate, linking IP to transaction

Exchange hot wallets, merchants, individual users

Critical

Run nodes behind Tor or I2P; disable incoming connections for sensitive wallets; use Dandelion++ stem phase correctly

Attacker injects long-lived malicious nodes into seed node crawler databases, persisting across restarts

All bootstrapping nodes using affected seed nodes

Medium

Seed operators must verify crawler integrity; node operators should clear peer databases periodically and cross-reference seed data

Attacker reroutes traffic to DNS seed IPs at the network layer, serving malicious responses

All nodes in affected network segments

High

Use DNSSEC validation; cross-check seed responses against known-good peer lists; monitor for unexpected seed IP changes

Attacker controlling eclipsed peers serves fake block headers to keep victim on a shadow chain

Exchanges, payment processors, block explorers

Critical

Verify block hashes against multiple independent sources; do not rely solely on P2P peers for chain validation

Attacker Sybil nodes log exact arrival times of transactions to correlate with network topology

Privacy-conscious users, shielded transaction originators

Medium

Use Dandelion++ with correct stem parameters; randomize transaction broadcast delays; avoid sending from identifiable IPs