An unknown person or group may be collecting the IP addresses of Bitcoin (BTC) users and linking them to their BTC addresses, violating the privacy of these users, according to a blog post from pseudonymous Bitcoin app developer 0xB10C. The entity has been active since March 2018, and its IP addresses have shown up on several public posts from Bitcoin node operators over the past several years.
0xB10C is the developer of several Bitcoin analytics websites, including Mempool.observer and Transactionfee.info. They have also been awarded a Bitcoin developer grant from Brink.dev in the past.
An entity I call LinkingLion, active since 2018 and on a Monero banlist, is opening connections to many clearnet Bitcoin nodes. Its presumably attempting to link transactions to node IPs. Maybe a chain analysis company trying to enhance its product?https://t.co/W4PDoln3p3
— 0xB10C (@0xB10C) March 28, 2023
0xB10C calls the entity “LinkingLion” because the IP addresses associated with it pass through LionLink network’s colocation data center. However, ARIN and RIPE registry information reveal that this company is probably not the originator of the messages, according to 0xB10C.
The entity uses a range of 812 different IP addresses to open connections with Bitcoin full nodes that are visible on the network (also called “listening nodes”). Once it opens a connection, the entity asks the node which version of the Bitcoin software it is using. However, when the node responds with a version number and message stating that it has understood the request, the entity closes its connection about 85% of the time without responding.
According to the post, this behavior may indicate that the entity is trying to determine if a particular node can be reached at a particular IP address.
While this behavior isn’t necessarily a cause for concern, it’s what the entity does the other 15% of the time that may be a concern. 0xB10C stated that about 15% of the time, LinkingLion doesn’t close the connection immediately. Instead, they either listen for inventory messages that contain transactions or send a request for an address and listen…
..
