Eclipse attack: an invisible threat capable of destroying a blockchain

What is an Eclipse attack?

There are many different threats to decentralized networks based on blockchain technology, ranging from a "51% attack" to vulnerabilities in smart contracts. However, some of these threats are more dangerous due to their stealth and difficulty of detection. One example of such a hidden threat is the Eclipse attack.

What is an Eclipse attack?

An Eclipse attack is a type of threat to decentralized networks in which some nodes of miners or validators are isolated, and most incoming and outgoing traffic is redirected through nodes controlled by attackers.

The term "Eclipse attack" derives from the similarity of its mechanism to a lunar eclipse: the Earth's satellite enters a "blind zone," just as isolated nodes in a decentralized network do.

The term "Eclipse attack" was first described in 2015 by researchers from Boston University in the original paper titled "Eclipse Attacks on Bitcoin's Peer-to-Peer Network."

In the same year, one of the paper's authors demonstrated an Eclipse attack on the Bitcoin network in practice, using a "bot army" of more than 4,500 IP addresses, during which a mining node was isolated for up to 5 hours.

Due to its similar mechanics, the Eclipse attack is often compared to another type of "phantom" blockchain threat — the Sybil attack, in which the network is gradually replaced by numerous malicious nodes. In fact, experts believe that the Eclipse attack is a special case of the Sybil attack.

How does an Eclipse attack work?

First, the attacker selects a target node for the Eclipse attack. After selecting the target node, the attacker begins sending numerous requests to it using a botnet, gradually isolating it and making it invisible to other participants.

As a result, the victim connects to fake nodes controlled by the attacker and begins receiving falsified data from them, which they continue to broadcast to the main network, putting its security at risk.

Subsequently, the data received by the isolated node can affect the operation of other nodes connected to it. In this way, attackers can gradually execute an Eclipse attack by replacing the real network with a phantom network.

Consequences of an Eclipse attack

An Eclipse attack is considered one of the most sophisticated and dangerous types of threats to blockchain systems. The danger of an Eclipse attack lies in the fact that operators cannot observe the operations of other nodes. Thus, during an Eclipse attack, attackers can imitate the behavior of real nodes while instead transmitting falsified transaction data to the network.

An Eclipse attack can lead to irreversible consequences for decentralized networks. One of the most dangerous possible outcomes of an Eclipse attack is double-spending — a situation in which the same assets are spent more than once.

Such an incident occurred with the Ethereum Classic blockchain in 2019. Attackers managed to replace the original nodes of the Ethereum Classic network with fake nodes and gain control over the network's connections. As a result of this Eclipse attack, the attackers were able to spend the network's native ETC coins twice and cause damage to the ecosystem exceeding $1 million.

Another danger of an Eclipse attack is the disruption of the network's consensus mechanism. Attackers can influence the process of cryptocurrency mining, affecting both PoW-based and PoS-based networks. This can lead to network malfunctions, including complete failure, and contribute to so-called "selfish mining"*.

* Selfish mining is a strategy in blockchain networks in which a miner or a group of miners deliberately withhold discovered blocks from the rest of the network to gain an advantage and increase their share of rewards.

The essence of the method is that attackers create a "private" blockchain and publish it only at the right moment, outpacing honest participants. This allows them to:

receive block rewards more frequently,
slow down the network,
undermine the fairness of the consensus mechanism.

Finally, if attackers successfully deploy their nodes and isolate the majority of legitimate nodes, they can carry out more complex schemes, such as a "51% attack."

How to prevent an Eclipse attack on a decentralized network?

The likelihood of an Eclipse attack is directly influenced by the size of the blockchain: the more nodes coordinate the network, the harder it is for attackers to carry out their plan. Large decentralized networks like Bitcoin and Ethereum have tens of thousands of nodes, making Eclipse attacks on them practically infeasible and requiring enormous time and resources.

Another way to mitigate the risks of an Eclipse attack is to reduce the predictability of node selection in the network — in other words, to make it more random. This prevents attackers from predicting which nodes will participate in the consensus process, potentially rendering their efforts ineffective. Such mechanisms are implemented in many modern blockchain networks, such as Ethereum, Elrond, and TON.

There are also other technical solutions to prevent Eclipse attacks, such as:

Increasing the number of TCP connections between nodes. This approach slows down the "eclipsing" process but reduces blockchain performance.
Node filtering. For example, creating a "whitelist" of permitted node addresses makes it harder for new participants to connect to the network. However, filtering may limit blockchain scalability and make it more centralized.
Systematic data collection and analysis by all network participants to verify nodes.
Continuous network monitoring and detection of suspicious activity patterns that may indicate a potential Eclipse attack;
Improving the overall network infrastructure, including the consensus mechanism, traffic routing algorithms, and node throughput.