Global botnets of "pwned" machines exist. Hypothetically, such a botnet could be configured to look a lot like the Bitcoin peer-to-peer network.

It could even have a long (fake) block chain, full of fake timestamps showing years' worth of history where the difficulty just never got very high.

My question is simple: How does the Bitcoin client know it is connected to the "real" Bitcoin P2P network and not to an impostor? That is, what mechanisms does it use to make this identification with confidence?

The more such mechanisms you identify, the better your answer is, in my view. Thanks.

2 Answers 2


There's a list of hardcoded blocks in the bitcoin client: https://github.com/bitcoin/bitcoin/blob/master/src/checkpoints.cpp

However, you present an entirely valid attack. If I can control one DNS seed and DDOS the others, I could cause new clients to only connect to my network.


You need to start at the Genesis block so you can't go back in time. And like Nick wrote, then the bitcoin-qt client has a list of "checkpoint" blocks which is hardcoded.

Also, the "correct blockchain" is defined by the one with the most work behind it (starting at the Genesis block ofc), so if you can see just one IP with the 'not-fake' blockchain, then he can prove that the millions of IP's you can see (the botnet) has a 'fake' blockchain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.