  The bitcoin peer-to-peer network has drawn significant attention from
researchers, but so far has mostly focused on publicly visible portions of the
network, i.e., publicly reachable peers. This mostly ignores the hidden parts
of the network: unreachable Bitcoin peers behind NATs and firewalls. In this
paper, we characterize Bitcoin peers that might be behind NATs or firewalls
from different perspectives. Using a special-purpose measurement tool we
conduct a large scale measurement study of the Bitcoin network, and discover
several previously unreported usage patterns: a small number of peers are
involved in the propagation of 89% of all bitcoin transactions, public cloud
services are being used for Bitcoin network probing and crawling, a large
amount of transactions are generated from only two mobile applications. We also
empirically evaluate a method that uses timing information to re-identify the
peer that created a transaction against unreachable peers. We find this method
very accurate for peers that use the latest version of the Bitcoin Core client.
