<p>It sounds to me like you are either running a compromised version of Bitcoin Core (<a href="https://bitcoincore.org/" rel="nofollow noreferrer">https://bitcoincore.org/</a>) or Electrum (<a href="https://electrum.org/" rel="nofollow noreferrer">https://electrum.org/</a>) or your laptop is compromised. A sybil attack is when all your peers are controlled by a malicious party and they control what transactions and blocks you see from the rest of the network. The attacker doesn't have access to your wallet, private keys, address generation, descriptors etc in a sybil attack scenario. I would recommend you install fresh verified versions of Bitcoin Core and Electrum on a different machine and if available use a hardware wallet/signer which is much harder for an attacker to compromise.</p>

CC BY-SA 4.0
2022-07-16T20:15:15.223Z
I have installed core from bitcoincore website, then verified it following the "Linux verification instructions" in the "download" page. For the electrum server, it was the fulcrum one, and I just installed from the official repo.
nourou4them
CC BY-SA 4.0
2022-07-16T20:21:06.093Z
How would you explain that after I discovered the attack and mitigated it, and after I restarted the node and the server, everything came back like before. I found again the descriptor and the receiving addresses I used to know ?
 It seems to me I was seeing a mirage, so it looked also like a MiM.
nourou4them
CC BY-SA 4.0
2022-07-17T13:45:11.180Z
@norou4them: If you are installing the right versions of Core and Electrum then that only leaves your machine as compromised. You may be being man in the middled sure. But that's not what we refer to as a "sybil attack".
Michael Folkson
CC BY-SA 4.0
2022-07-18T11:17:06.460Z
Indeed. Do you have any best practice guide to secure an ubuntu machine hosting a node ?
nourou4them
CC BY-SA 4.0
2022-07-18T12:08:00.583Z
@nourou4them: I don't, no. You could ask on the Security StackExchange https://security.stackexchange.com/. Unless you're an expert I would install Bitcoin Core and Electrum on new hardware and not install anything non Bitcoin related on that hardware. The more you install the greater the attack surface.
Michael Folkson
CC BY-SA 4.0
2022-07-16T15:27:01.297Z
2022-07-16T15:27:01.297Z
Michael Folkson
<p>So I am currently working on a project using bitcoin.
I started with a full node that I tried to secure following the best practices available online.</p>
<p>Then, I set up an electrum server that was connected to the full node and on top of which I linked a software wallet, being most of the time a cold one.
In order to follow up this particular server' status, I added it to a notification service provided by <a href="https://1209k.com/bitcoin-eye/ele.php?chain=btc" rel="nofollow noreferrer">this website</a>.
And that's when things started to get weird.</p>
<p>I suddently started to see the full node being always 1 to 2 blocks behind the current block height. I then saw 3 connections on average to the electrum server from IP addresses that I didn't own. Finally, I saw that my wallet descriptor has been changed and that the receiving addresses of the wallet have been modified. So everytime I would receive a new transaction, it would generate a new address that was not derived from my private key.</p>
<p>But here is the most interesting part. For testing purpose, I had made an incoming transaction to that wallet, days before, using the first generated address that I will call &quot;A&quot;. After I started to have doubts, I went back to verify the list of generated addresses and I couldn't find &quot;A&quot; anymore. It was visualy replaced by a random address &quot;B&quot;, with the same transaction but no other information has changed (txid, inputs, outputs...). That list was different from the list I used to see in the wallet.</p>
<p>That's when I came back to the electrum server, seeing new connections every second, from different IP addresses. I thought &quot;I'm being DDOSing&quot;. After seeing my full node being always late catching the last block, I was finally sure that I was victim of a <a href="https://www.coindesk.com/markets/2016/11/13/bitcoins-security-model-a-deep-dive/" rel="nofollow noreferrer">sybil attack</a>.</p>
<p>I then started to mitigate the attack by doing some tasks on the wallet, the electrum server and the bitcoin core node. I am not sure if it will be enough but like someone said to me one day, &quot;there are lots of things to consider... and security-wise etc. it's a huge undertaking with lots of risks.&quot;</p>
<p>Edit : Adding the following question.</p>
<p>Question : How was it possible for the attacker to change the descriptor and the receiving address of my wallet, through the electrum server? Is there any other vulnerabilities I should be aware of in order to mitigate the risks ?</p>

CC BY-SA 4.0
2022-07-16T14:04:10.100Z
Hi nourou4them, I don't see a question in your post.
Vojtěch Strnad
CC BY-SA 4.0
2022-07-16T14:19:14.433Z
@VojtěchStrnad I just added it.
nourou4them
<bitcoin-core><wallet><sybil-attack><electrum-server>
I think I was victim of a sybil attack
nourou4them
# I think I was victim of a sybil attack

(Asked by: username_0 on 2022-07-16)

So I am currently working on a project using bitcoin.
I started with a full node that I tried to secure following the best practices available online.

Then, I set up an electrum server that was connected to the full node and on top of which I linked a software wallet, being most of the time a cold one.
In order to follow up this particular server' status, I added it to a notification service provided by [this website](https://1209k.com/bitcoin-eye/ele.php?chain=btc).
And that's when things started to get weird.

I suddently started to see the full node being always 1 to 2 blocks behind the current block height. I then saw 3 connections on average to the electrum server from IP addresses that I didn't own. Finally, I saw that my wallet descriptor has been changed and that the receiving addresses of the wallet have been modified. So everytime I would receive a new transaction, it would generate a new address that was not derived from my private key.

But here is the most interesting part. For testing purpose, I had made an incoming transaction to that wallet, days before, using the first generated address that I will call "A". After I started to have doubts, I went back to verify the list of generated addresses and I couldn't find "A" anymore. It was visualy replaced by a random address "B", with the same transaction but no other information has changed (txid, inputs, outputs...). That list was different from the list I used to see in the wallet.

That's when I came back to the electrum server, seeing new connections every second, from different IP addresses. I thought "I'm being DDOSing". After seeing my full node being always late catching the last block, I was finally sure that I was victim of a [sybil attack](https://www.coindesk.com/markets/2016/11/13/bitcoins-security-model-a-deep-dive/).

I then started to mitigate the attack by doing some tasks on the wallet, the electrum server and the bitcoin core node. I am not sure if it will be enough but like someone said to me one day, "there are lots of things to consider... and security-wise etc. it's a huge undertaking with lots of risks."

Edit : Adding the following question.

Question : How was it possible for the attacker to change the descriptor and the receiving address of my wallet, through the electrum server? Is there any other vulnerabilities I should be aware of in order to mitigate the risks ?

**Tags:** bitcoin-core, wallet, sybil-attack, electrum-server

> **Comments:**
> **username_1**: Hi username_0, I don't see a question in your post.  
> **username_0**: @username_1 I just added it.  

---

## 1 answers

### Answer by username_2 on 2022-07-16. Score: 3 | Accepted answer

It sounds to me like you are either running a compromised version of Bitcoin Core (<https://bitcoincore.org/>) or Electrum (<https://electrum.org/>) or your laptop is compromised. A sybil attack is when all your peers are controlled by a malicious party and they control what transactions and blocks you see from the rest of the network. The attacker doesn't have access to your wallet, private keys, address generation, descriptors etc in a sybil attack scenario. I would recommend you install fresh verified versions of Bitcoin Core and Electrum on a different machine and if available use a hardware wallet/signer which is much harder for an attacker to compromise.

> **Comments:**
> **username_0**: I have installed core from bitcoincore website, then verified it following the "Linux verification instructions" in the "download" page. For the electrum server, it was the fulcrum one, and I just installed from the official repo.  
> **username_0**: How would you explain that after I discovered the attack and mitigated it, and after I restarted the node and the server, everything came back like before. I found again the descriptor and the receiving addresses I used to know ?  It seems to me I was seeing a mirage, so it looked also like a MiM.  
> **username_2**: @norou4them: If you are installing the right versions of Core and Electrum then that only leaves your machine as compromised. You may be being man in the middled sure. But that's not what we refer to as a "sybil attack".  
> **username_0**: Indeed. Do you have any best practice guide to secure an ubuntu machine hosting a node ?  
> **username_2**: @username_0: I don't, no. You could ask on the Security StackExchange https://security.stackexchange.com/. Unless you're an expert I would install Bitcoin Core and Electrum on new hardware and not install anything non Bitcoin related on that hardware. The more you install the greater the attack surface.  

---

