Connect with us

Hi, what are you looking for?


Mysterious Entity Is Collecting BTC Users’ IP Addresses

Image Source: Svet foto / Shutterstock

An unknown person or group may be collecting the IP addresses of Bitcoin (BTC) users and linking them to their BTC addresses, violating the privacy of these users, according to a blog post from pseudonymous Bitcoin app developer 0xB10C. The entity has been active since March 2018, and its IP addresses have shown up on several public posts from Bitcoin node operators over the past several years.

0xB10C is the developer of several Bitcoin analytics websites, including and They have also been awarded a Bitcoin developer grant from in the past.

0xB10C calls the entity “LinkingLion” because the IP addresses associated with it pass through LionLink network’s colocation data center. However, ARIN and RIPE registry information reveal that this company is probably not the originator of the messages, according to 0xB10C.

The entity uses a range of 812 different IP addresses to open connections with Bitcoin full nodes that are visible on the network (also called “listening nodes”). Once it opens a connection, the entity asks the node which version of the Bitcoin software it is using. However, when the node responds with a version number and message stating that it has understood the request, the entity closes its connection about 85% of the time without responding.

According to the post, this behavior may indicate that the entity is trying to determine if a particular node can be reached at a particular IP address.

While this behavior isn’t necessarily a cause for concern, it’s what the entity does the other 15% of the time that may be a concern. 0xB10C stated that about 15% of the time, LinkingLion doesn’t close the connection immediately. Instead, they either listen for inventory messages that contain transactions or send a request for an address and listen for both inventory and address messages. They then close the connection within 10 minutes.

This behavior would normally indicate that the user is a node trying to update its copy of the blockchain. However, LinkingLion never requests blocks or transactions, which implies that they must be pursuing some other purpose, the post said.

0xB10C stated that LinkingLion might be recording the timing of transactions to determine which node first received a transaction, which can then be used to determine the IP address associated with a particular Bitcoin address, as they explained:

Connections that complete the version handshake and stay connected learn about our node’s inventory, like transactions and blocks. The timing information, i.e., when a node announces its new inventory, is especially relevant. The entity is likely to first learns about our new wallet transaction from us. As the entity is connected to many listening nodes, it can use that information to link broadcast transactions to IP addresses.

To help protect the community from this privacy threat, 0xB10C has produced an open-source ban list that nodes can implement to ban LinkingLion from connecting to them. However, he also warned that the entity could get around this ban list by changing the IP addresses it uses to connect. In 0xB10C’s view, the only permanent solution to the problem is to change the transaction logic within Bitcoin Core, which developers have so far been unable to do.

The vulnerability exposed in the post seems to primarily affect users running their own Bitcoin nodes. 0xB10C did not say whether it also affects ordinary users relying on Electrum or other Bitcoin wallets that connect to third-party nodes, nor did they say whether users can defend against the attack using a virtual private network. Cointelegraph has reached out to 0xB10C on LinkedIn to get answers to these questions but was unable to reach them by the time of publication.

Privacy has been a continuing concern for Bitcoin and crypto users over the years. Although Bitcoin addresses are pseudonymous, their transaction histories are entirely public. Bitcoin educator Andreas Antonopoulos has argued that Bitcoin will never be truly private. But Breeze Wallet has attempted to improve privacy on the network by utilizing offchain transactions and cryptographic puzzles.

Image Source: Svet foto / Shutterstock

You May Also Like


In the past year, Peloton, manufacturers of stationary exercise bicycles and treadmills, has been experiencing some severe financial difficulties. The company went through a...


While the ongoing supply chain problems affecting the global economy have had the expected effects, they’ve also had some decidedly unexpected effects. Specifically, many...


As gas prices continue to rise and consumer confidence drops, not to mention the ongoing war in Ukraine, the European economy is taking a...


As the environmental need for electric vehicles becomes more pressing, and the car-buying public becomes more eager for them, automotive manufacturers are getting ready...


This morning, Coinbase CEO Brian Armstrong sent a mass email out to his company informing everyone that, as stock and crypto prices slip and...


As Russia’s invasion of Ukraine continues, many global businesses have pulled their dealings out of Russian territories due to a mix of sanctions and...


In the last few weeks, fears have begun to surface of another potential recession striking the United States economy. Economists have been working to...


It’s no secret that the highs of the COVID-19 pandemic cost movie theater chain AMC an unprecedented amount of money. As people isolated at...