I came across this paper Eclipse Attacks on Bitcoin’s Peer-to-Peer Network ∗ that sounds very similar to the Sybil attack.

Can someone point out the difference between both attacks.

An eclipse attack is when most (if not all) of your peers are malicious and they basically prevent you from being well-connected to the network to obtain information about transactions you're interested in. An eclipse attack is particular useful when a payer has sent some bitcoins to you in some transaction, then decides to also doublespend the same bitcoins. The doublespender (or payer) will use the eclipse attack to prevent you from knowing that there is also a doublespend transaction out in the open, so you get misled into believing that there's only the original transaction.

A sybil attack on the other hand is where a malicious actor is trying to spam the network with nodes that they control attempting to subvert the network's reputation system. For example, false signalling of support using version bits.

To summarise, an eclipse attack is targeted at a single party; whereas a sybil attack is network targeted. In the context of bitcoin, a sybil attack is not particularly harmful since all nodes operate based on consensus rules and any deviation will lead to said node getting DoS banned.

  • 2
    I think it's worth pointing out that in the Bitcoin and cryptocurrency space, the term "Sybil attack" was traditionally used for both actual Sybil attacks and what is now known as eclipse attacks, due to there not really being a good term for the second until it was introduced by the paper referred to by OP. – Pieter Wuille Mar 20 at 0:30

In a sybil attack, the attacker impersonates multiple identities.

In an eclipse attack, the attacker eclipses a victim from the network. That means the attacker basically controls which information the victim is able to send to the network and vice versa.

I would therefore say that a sybil attack is what an adversary uses in order to perform an eclipse attack. This is because a Bitcoin node normally connects to multiple peers. The adversary therefore would have to impersonate all peers of the victim in order to eclipse the victim from the rest of the network.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.