Can one, theoretically, write a program that is similar to a solo miner but instead it just logs IPs of other computers on the bitcoin net to trace IPs that might have bitcoin wallets on them and then to use that list as a preferable hacking list ?

I think we can differ between 3 types nodes: 1. people running just the bitcoin client as a wallet 2. people solo mining 3. people pool mining

I am almost sure that the 3rd option is not traceable (assuming the pool servers are secure). What about the detectability of the first 2 (especially the solo mining).

1 Answer 1


Not only can you write such a program, you probably already have one. If you run the standard Bitcoin Core client, you will see that debug.log logs the IP addresses of every network node it communicates with. (It's irrelevant whether you use the client for mining or not - even non-mining nodes need to connect to peers, and could keep track of which peers they have found.)

On the one hand, an attacker could consider these targets more tempting, on the grounds that there might be bitcoins stored on those machines. On the other hand, since at present Bitcoin users tend to be more technically skilled than the general public, these machines might be better secured than the average computer on the Internet, making them harder targets.

Ordinary clients and solo miners are both likely to run regular Bitcoin clients. I don't know of any reliable way for an attacker to tell whether a node is mining or not. The best approach might be for the attacker to have a large number of nodes, each connected to a large number of peers, and watch for the first appearance of a new block. The first node to have sent out that block is somewhat more likely to be the miner that found it - but the attacker can't rule out the possibility that that node was simply relaying a block sent to it by someone else.

Anyway, it's not clear that a solo miner would be a more profitable target than anyone else on the network - miners don't necessarily store their earned coins on the mining machine. The attacker could take control of a solo miner and make it mine for her instead, but odds are that she would be discovered long before the miner finds a block. (She would certainly be discovered as soon as it did find one, when the miner notices that the block reward didn't go to the right place.)

Pool miners don't need to participate in the peer-to-peer Bitcoin network, so they could not be discovered in this way. The pool operator can run a regular Bitcoin node that looks no different from any other node.

  • Thanks a lot ! probably the most interesting fact I didn't know was that the protocol does not differentiate between discovering a winning block and relaying it - which is great.
    – thedrs
    Sep 10, 2014 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.