Eclipse Attack

Key points

• In an eclipse attack, a specific node is surrounded by malicious peers that come to control its entire view of the network.
• Isolated from honest participants, the node only receives information filtered by the attacker, which can make it see a distorted version of reality.
• It is an attack aimed at individual targets, unlike attacks that seek to dominate the entire network.

What is an eclipse attack?

An eclipse attack is an assault in which a network participant is isolated from the rest through malicious connections. In distributed networks, each node connects to a set of peers to exchange information. In an eclipse attack, the attacker manages to make all, or nearly all, of those connections be with nodes it controls, eclipsing the target's view of the rest of the network.

How it works

The attacker seeks to occupy all of the victim node's connections. To do this, it can create many nodes under its control and manipulate the way the target chooses its peers, until the honest node is surrounded only by malicious participants. From then on, the attacker controls the flow of information reaching and leaving that node, deciding what it sees and what it can transmit to the rest of the network.

With this control, several possibilities for abuse open up. The attacker can hide transactions from the victim node, show it an outdated or false version of the ledger, or induce it to accept incorrect information. In certain scenarios, this can be combined with other fraud, such as trying to make the target accept a payment that is not actually final, taking advantage of its distorted view of the network.

Defense involves making it harder for a single agent to occupy all of a node's connections. Well-designed networks adopt more robust ways of selecting peers, increase connection diversity, and create obstacles to the mass creation of fake nodes. The eclipse attack is also related to the Sybil attack, in which an agent creates many fake identities, since creating many nodes is often the initial step toward eclipsing a target.

Understanding this vector helps in appreciating the protections that networks adopt against it.

Why it matters

Understanding the eclipse attack helps clarify that a network's security does not depend only on resisting large-scale attacks, but also on protecting individual participants. For those who operate a node or receive payments, this is a relevant risk context. This is a technical concept and does not represent any operational recommendation.

Risks and limitations

An eclipsed node can be deceived about the actual state of the network, accepting false information or payments that are not final. The attack is more feasible against poorly connected or poorly configured nodes. Although mature networks adopt defenses, no protection is absolute, and operating with few connections or outdated software increases exposure to this type of isolation.