Are Unreachable Nodes Truly Safe? Fully Eclipsing Monero's P2P Network!
Researchers present Nyx and Moros, the first eclipse attacks against Monero nodes behind NATs, requiring no inbound access and demonstrated on mainnet.
The paper presents the first eclipse attacks tailored to unreachable Monero nodes operating behind NATs, requiring no inbound access to the victim. The attacks poison the peerlists of reachable nodes, which relay contamination to unreachable nodes' whitelists, then exploit Monero's outbound connection refresh logic to evict benign neighbors and monopolize all outbound connections. Nyx achieves a complete, persistent eclipse of long-running unreachable nodes in large-scale SEED Emulator simulations, while Moros stealthily eclipses newly joined nodes during bootstrapping and was demonstrated on the Monero mainnet. Countermeasures are proposed.
- First eclipse attacks against NAT-unreachable Monero nodes without inbound access
- Attacks poison reachable nodes' peerlists to contaminate unreachable whitelists
- Nyx achieves persistent network-wide eclipse in emulation; Moros works on mainnet
- Countermeasures proposed for Monero's P2P network
Full article222 words · extracted from arxiv.org · click to collapse
Eclipse attacks isolate a blockchain node by monopolizing its network connections. Existing attacks on Monero (NDSS'25), Bitcoin (USENIX'15/21, S&P'20) and Ethereum (WWW'26) implicitly assume that the adversary can establish inbound connections, thereby excluding a large and practically dominant class of nodes: \textit{unreachable nodes} operating behind NATs. Such nodes are widely believed to enjoy stronger networks. We challenge this assumption and show that unreachability does NOT imply the expected resilience! We present the first eclipse attacks tailored to unreachable nodes in Monero's P2P network. Our attacks require no inbound access to the victim. Instead, they first poison the peerlist of reachable nodes, which subsequently act as propagation relays to contaminate unreachable nodes' whitelists. The adversary then exploits Monero's built-in outbound connection refresh logic to evict benign neighbors and eventually monopolize all outbound connections. We instantiate this strategy in two attacks: Nyx, which targets long-running unreachable nodes and achieves a complete and persistent eclipse through network-wide poisoning; and Moros, a stealthier attack that exploits the bootstrapping phase to rapidly eclipse newly joined unreachable nodes. We ethically evaluate both attacks. Nyx is validated via large-scale simulations on a Monero network constructed using the SEED Emulator, while Moros is demonstrated on the Monero mainnet against controlled targets. Our results show that unreachable nodes can be reliably driven into stable, long-lived eclipse states. We also propose countermeasures.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.10260