So I am currently working on a project using bitcoin. I started with a full node that I tried to secure following the best practices available online.

Then, I set up an electrum server that was connected to the full node and on top of which I linked a software wallet, being most of the time a cold one. In order to follow up this particular server' status, I added it to a notification service provided by this website. And that's when things started to get weird.

I suddently started to see the full node being always 1 to 2 blocks behind the current block height. I then saw 3 connections on average to the electrum server from IP addresses that I didn't own. Finally, I saw that my wallet descriptor has been changed and that the receiving addresses of the wallet have been modified. So everytime I would receive a new transaction, it would generate a new address that was not derived from my private key.

But here is the most interesting part. For testing purpose, I had made an incoming transaction to that wallet, days before, using the first generated address that I will call "A". After I started to have doubts, I went back to verify the list of generated addresses and I couldn't find "A" anymore. It was visualy replaced by a random address "B", with the same transaction but no other information has changed (txid, inputs, outputs...). That list was different from the list I used to see in the wallet.

That's when I came back to the electrum server, seeing new connections every second, from different IP addresses. I thought "I'm being DDOSing". After seeing my full node being always late catching the last block, I was finally sure that I was victim of a sybil attack.

I then started to mitigate the attack by doing some tasks on the wallet, the electrum server and the bitcoin core node. I am not sure if it will be enough but like someone said to me one day, "there are lots of things to consider... and security-wise etc. it's a huge undertaking with lots of risks."

Edit : Adding the following question.

Question : How was it possible for the attacker to change the descriptor and the receiving address of my wallet, through the electrum server? Is there any other vulnerabilities I should be aware of in order to mitigate the risks ?

  • 1
    Hi nourou4them, I don't see a question in your post. Jul 16 at 14:04
  • @VojtěchStrnad I just added it. Jul 16 at 14:19

1 Answer 1


It sounds to me like you are either running a compromised version of Bitcoin Core (https://bitcoincore.org/) or Electrum (https://electrum.org/) or your laptop is compromised. A sybil attack is when all your peers are controlled by a malicious party and they control what transactions and blocks you see from the rest of the network. The attacker doesn't have access to your wallet, private keys, address generation, descriptors etc in a sybil attack scenario. I would recommend you install fresh verified versions of Bitcoin Core and Electrum on a different machine and if available use a hardware wallet/signer which is much harder for an attacker to compromise.

  • I have installed core from bitcoincore website, then verified it following the "Linux verification instructions" in the "download" page. For the electrum server, it was the fulcrum one, and I just installed from the official repo. Jul 16 at 20:15
  • How would you explain that after I discovered the attack and mitigated it, and after I restarted the node and the server, everything came back like before. I found again the descriptor and the receiving addresses I used to know ? It seems to me I was seeing a mirage, so it looked also like a MiM. Jul 16 at 20:21
  • 1
    @norou4them: If you are installing the right versions of Core and Electrum then that only leaves your machine as compromised. You may be being man in the middled sure. But that's not what we refer to as a "sybil attack". Jul 17 at 13:45
  • Indeed. Do you have any best practice guide to secure an ubuntu machine hosting a node ? Jul 18 at 11:17
  • 1
    @nourou4them: I don't, no. You could ask on the Security StackExchange security.stackexchange.com. Unless you're an expert I would install Bitcoin Core and Electrum on new hardware and not install anything non Bitcoin related on that hardware. The more you install the greater the attack surface. Jul 18 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.