I read in several paper that PoW deters Sybil attack in Bitcoin. However, there is no enough explanation about how proof-of-work detects Sybil attack in Bitcoin?


2 Answers 2


PoW does not detect sybil attacks, it prevents them. Sybil, or sockpuppet, attack means that an attacker can spawn a large number of nodes which they control.

If your full node suddenly finds itself connected to fake nodes spawned by an attacker which claim that difficulty of the block they are sending you is much less than it was upto now, your node will know something is wrong and discard those blocks. The idea is that those fake nodes would have to mine at the current difficulty, but at that point they are not fake/sybil nodes, they are miners.

Similarly, when you run a full node for the first time you need to be able to connect to other nodes in the network to receive all the blocks that occured in the network so far. If by some chance your node connects to attacker's nodes they could try faking the transaction history. But since each block contains the difficulty at which it was mined, fake nodes being regular pc's or something like that would produce blocks at very low difficulties. If you ever connected to a real node, you would quickly discover that your node is under attack and receive the real history.

The point is that if the fake nodes wanted to produce blocks at anything close to the current difficulty, they couldn't be just regular PC's and just fake the difficulty. They would have to be miners like the rest of the network, but then they are entering the race with other miners to produce blocks (or are trying to pull off a 51% attack).


A Sybil attack is based on spawning a large number of instances to either isolate the attacked from other nodes, or to fake support for something.

Proof of work requires expenditure of irretrievable resources to perform. Proof of work cannot be faked by spinning up more instances of the software, the energy actually has to be spent. In that sense PoW prevents Sybil attacks: even when an attacker isolates your node, they can only prevent you from getting updates from the network but not make you believe anything that the network hasn't actually agreed upon (unless they also sacrifice immense amounts of PoW).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.