<p>It is impossible to say what the probability of a sybil attack is as (as far as I'm aware) there are no public data sources on how many users/nodes have been subject to sybil attacks and no reliable reporting when occurrences happen.</p>
<p>However, I think it is safe to say the probability of a normal user being subject to a sybil attack is pretty low as it is hard for the attacker to prevent you connecting to a single honest node and there is very little for an attacker to gain unless they have significant hash power and can compete in the mining of blocks. Without significant hash power all they can do is prevent you from receiving the latest blocks and latest transactions. There is more to gain from sybil attacking mining pools as in theory the attacker could prevent mined blocks from being propagated across the network and prevent them from receiving block reward(s).</p>
<p>With regards to mechanisms in say Bitcoin Core, it is impossible to identify ahead of time which peers are malicious and controlled by the same party. All nodes are treated the same on the network unless and until they start misbehaving (e.g. propagate invalid transactions, blocks). There is some ongoing work (<a href="https://blog.bitmex.com/call-to-action-testing-and-improving-asmap/" rel="nofollow noreferrer">asmap</a>) to ensure greater diversification of peer selection through stronger bucketing. There are also various things you can do proactively as a user. If there is a node you trust you can <a href="https://bitcoin.stackexchange.com/questions/41426/how-do-i-configure-bitcoin-core-to-connect-always-to-a-particular-node">connect</a> to this peer manually. If you haven't been receiving blocks for a number of hours (and you have peers) you can check a block explorer (<a href="https://mempool.space/" rel="nofollow noreferrer">mempool.space</a>, <a href="https://blockstream.info/" rel="nofollow noreferrer">blockstream.info</a> etc) to see if there have been blocks mined in this time. Although you generally shouldn't need to, doing out of band checks can give you the assurance that your node isn't subject to a sybil attack.</p>

CC BY-SA 4.0
2022-12-13T20:53:18.360Z
Probability is the wrong thing to ask about. Attacks don't happen randomly; they happen deliberately. The question to ask is what the attack costs, and what someone stands to gain from it (this is more a comment on the question than on the answer, just pointing out that it's inherently unanswerable).
Pieter Wuille
CC BY-SA 4.0
2022-12-14T08:31:38.293Z
@PieterWuille: I agree the attack costs are highly relevant. The higher the cost the more out of reach the attack is from most potential perpetuators. I'm skeptical on trying to assess "what someone stands to gain from it". It could be anyone from a Western state actor to a rogue state actor to an altcoin advocate to just a well resourced bored hacker. If an attack is possible and affordable it could be carried out for multiple reasons. That's why I think probability factors in. If you just want to cause disruption you are going to pick the lowest hanging (most probable to succeed) fruit first
Michael Folkson
CC BY-SA 4.0
2022-12-14T08:33:50.123Z
Admittedly this isn't an exact science and you may have given this much more thought than me! But that's my current thinking anyway :)
Michael Folkson
CC BY-SA 4.0
2022-07-16T18:47:42.833Z
2022-07-16T19:01:43.817Z
2022-07-16T19:01:43.817Z
Michael Folkson
<p>One cool thing about Bitcoin is that coins are inherently scarse and this is by itself a huge protection from sybil attacks. In other P2P systems, sybil attacks are much harder to prevent because there's no such concept of scarcity. In Bitcoin, a sybil attack would be achieved if one has lot of coins, by sending tons of transactions, and therefore spending such coins.</p>

<p>There are other types of sybil attacks such as overloading nodes connections, and the recent one of filling up the memory pool of specific nodes with really tiny transactions. A way to prevent these would be for example to increase the fees.</p>

CC BY-SA 3.0
2015-07-14T19:49:10.957Z
How does coin distribution have anything to do with a Sybil attack?
Claris
CC BY-SA 3.0
2015-07-14T21:43:50.403Z
because the transaction, which is what might be sent across the network to produce a sybil attack, represents a transfer of value and therefore cannot be simulated by a gazillion simulated peers to disrupt such network: the size of his attack is always proportional to the amount of transferable coins he owns.
Luca Matteis
CC BY-SA 3.0
2015-07-14T18:06:03.800Z
2015-07-14T18:06:03.800Z
Luca Matteis
<p>I'd like to know what's the probability of a sybil attack and if there are mechanisms built in to prevent this kind of attack?</p>

<p2p><sybil-attack>
How probable is a sybil attack?
Aliakbar Ahmadi
# How probable is a sybil attack?

(Asked by: username_0 on 2015-07-14)

I'd like to know what's the probability of a sybil attack and if there are mechanisms built in to prevent this kind of attack?

**Tags:** p2p, sybil-attack


---

## 2 answers

### Answer by username_1 on 2022-07-16. Score: 1

It is impossible to say what the probability of a sybil attack is as (as far as I'm aware) there are no public data sources on how many users/nodes have been subject to sybil attacks and no reliable reporting when occurrences happen.

However, I think it is safe to say the probability of a normal user being subject to a sybil attack is pretty low as it is hard for the attacker to prevent you connecting to a single honest node and there is very little for an attacker to gain unless they have significant hash power and can compete in the mining of blocks. Without significant hash power all they can do is prevent you from receiving the latest blocks and latest transactions. There is more to gain from sybil attacking mining pools as in theory the attacker could prevent mined blocks from being propagated across the network and prevent them from receiving block reward(s).

With regards to mechanisms in say Bitcoin Core, it is impossible to identify ahead of time which peers are malicious and controlled by the same party. All nodes are treated the same on the network unless and until they start misbehaving (e.g. propagate invalid transactions, blocks). There is some ongoing work ([asmap](https://blog.bitmex.com/call-to-action-testing-and-improving-asmap/)) to ensure greater diversification of peer selection through stronger bucketing. There are also various things you can do proactively as a user. If there is a node you trust you can [connect](https://bitcoin.stackexchange.com/questions/41426/how-do-i-configure-bitcoin-core-to-connect-always-to-a-particular-node) to this peer manually. If you haven't been receiving blocks for a number of hours (and you have peers) you can check a block explorer ([mempool.space](https://mempool.space/), [blockstream.info](https://blockstream.info/) etc) to see if there have been blocks mined in this time. Although you generally shouldn't need to, doing out of band checks can give you the assurance that your node isn't subject to a sybil attack.

> **Comments:**
> **username_2**: Probability is the wrong thing to ask about. Attacks don't happen randomly; they happen deliberately. The question to ask is what the attack costs, and what someone stands to gain from it (this is more a comment on the question than on the answer, just pointing out that it's inherently unanswerable).  
> **username_1**: @username_2: I agree the attack costs are highly relevant. The higher the cost the more out of reach the attack is from most potential perpetuators. I'm skeptical on trying to assess "what someone stands to gain from it". It could be anyone from a Western state actor to a rogue state actor to an altcoin advocate to just a well resourced bored hacker. If an attack is possible and affordable it could be carried out for multiple reasons. That's why I think probability factors in. If you just want to cause disruption you are going to pick the lowest hanging (most probable to succeed) fruit first  
> **username_1**: Admittedly this isn't an exact science and you may have given this much more thought than me! But that's my current thinking anyway :)  

---

### Answer by username_3 on 2015-07-14. Score: -2

One cool thing about Bitcoin is that coins are inherently scarse and this is by itself a huge protection from sybil attacks. In other P2P systems, sybil attacks are much harder to prevent because there's no such concept of scarcity. In Bitcoin, a sybil attack would be achieved if one has lot of coins, by sending tons of transactions, and therefore spending such coins.

There are other types of sybil attacks such as overloading nodes connections, and the recent one of filling up the memory pool of specific nodes with really tiny transactions. A way to prevent these would be for example to increase the fees.

> **Comments:**
> **username_4**: How does coin distribution have anything to do with a Sybil attack?  
> **username_3**: because the transaction, which is what might be sent across the network to produce a sybil attack, represents a transfer of value and therefore cannot be simulated by a gazillion simulated peers to disrupt such network: the size of his attack is always proportional to the amount of transferable coins he owns.  

---

