Bitcoin Network Flooded With 200,000 'Ghosts', Core Dev Jameson Lopp Warns About Stealth Sybil Attack

Cover image via depositphotos.com Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available. A large-scale infrastructure anomaly has been detected in Bitcoin's P2P network , potentially representing hidden preparation for a technical attack. Starting on April 9, 2026, the chart tracking unsolicited network messages (ADDR) showed a vertical spike: the number of fake and unreachable node addresses surged from a baseline of 50,000 to more than 250,000 per day. Advertisement The graphical spike was highlighted by well-known developer and Casa co-founder Jameson Lopp , who suggested that someone may be intentionally flooding communication channels with false coordinates as part of preparations for a Sybil attack. Signs of a stealth sybil attack against Bitcoin The attacker appears to have chosen a silent strategy. Instead of directly attacking block validation or transaction processing, unknown actors are attempting to rewrite Bitcoin's "phone book" - nodes exchange each other's addresses through ADDR commands so that new participants can quickly discover peers for synchronization. HOT Stories Ripple's 'North Star' XRP Doubles ETF Inflows Amid Tokenization Breakthrough; SHIB Decouples From Dogecoin; Bitcoin Eyes $94,500 as 'Sell in May' Trigger: Bollinger Bands - Morning Crypto Report Avalanche Founder Warns of Bitcoin (BTC) Crisis By flooding the network with hundreds of thousands of fake IP addresses, the attacker is probably attempting to ensure that newly launched or restarted nodes connect exclusively to nonexistent or attacker-controlled "ghost nodes". Advertisement If this chart is accurate, somebody's being naughty and trying to spread a bunch of fake bitcoin node addresses around Bitcoin's p2p network. Possibly preparation for a sybil attack? pic.twitter.com/IuWkvkUzjm — Jameson Lopp (@lopp) May 10, 2026 In theory, such a tactic could lead to an Eclipse attack, where a legitimate node becomes trapped in an informational vacuum and only sees the version of the blockchain presented by the attacker. However, in order to remain secure and receive accurate blockchain data, a node only needs to establish a connection with at least one honest participant in the network. You Might Also Like Sun, 05/10/2026 - 13:25 Ripple's 'North Star' XRP Doubles ETF Inflows Amid Tokenization Breakthrough; SHIB Decouples From Dogecoin; Bitcoin Eyes $94,500 as 'Sell in May' Trigger: Bollinger Bands - Morning Crypto Report By Gamza Khanzadaev Advertisement Bitcoin's client software also automatically distributes connections across different subnets, making it difficult for an attacker to monopolize all connection slots from a single IP address pool. At the moment, the anomaly appears to create more parasitic bandwidth load than a direct threat to consensus itself. The market, meanwhile, either has not yet priced in the potential risk of such an attack or considers it insignificant in the context of the possible impact and existing countermeasures. At the time of writing, Bitcoin was up 0.36% since the start of the new trading session and was trading at $81,000. #Bitcoin #Cryptocurrency Scam #Bitcoin News