What Is a Sybil Attack?
A Sybil attack floods a network with fake identities controlled by one adversary. In anonymity networks, this means running many malicious nodes to increase the chance of observing user traffic.
Attack Scenario
Normal Network: [Node A] → [Node B] → [Node C]
(independent operators)
Sybil Attack: [Evil 1] → [Evil 2] → [Evil 3]
(all controlled by adversary)
Targets
Tor Network
Run malicious relays to observe traffic
AnonymityDHT Networks
Control routing in distributed hash tables
P2PCryptocurrencies
Eclipse attacks isolate target nodes
BlockchainReputation Systems
Fake reviews and ratings manipulation
TrustReal-World Examples
KAX17 (2021)Malicious Tor relays captured significant traffic
Bitcoin EclipseAcademic demonstration of node isolation
BitTorrent DHTMonitoring torrents via DHT infiltration
Defenses
- Proof-of-work or proof-of-stake requirements
- Web of trust identity verification
- Reputation systems with history
- Guard nodes in Tor (fewer entry points)
- Network diversity requirements
- Resource testing (bandwidth verification)