Search Results

Monero, the leading privacy-focused cryptocurrency, relies on a peer-to-peer (P2P) network to propagate transactions and blocks. Growing evidence suggests that non-standard nodes exist in the network, posing as honest nodes but are perhaps intended for monitoring the network and spying on other nodes. However, our understanding of the detection and analysis of anomalous peer behavior remains limited. This paper presents a systematic methodology for detecting anomalous peer behavior in P2P cryptocurrency networks, which we apply in a forensic case study of Monero’s network. We collected and analyzed over 240 hours of network traffic captured from five distinct vantage points worldwide. We further present a formal framework which allows us to analytically define and classify anomalous patterns in P2P cryptocurrency networks. Our detection methodology defines detection rules directly applicable to real-time monitoring. Our analysis reveals the presence of non-standard peers in the network where approximately 14.38% (1,877 of 13,050) of the observed peers exhibit anomalous behavior. Of these, at least 1,582 peers show patterns consistent with control by a single entity. These peers exhibit behavioral patterns consistent with a Sybil attack coupled with self-reinforcing peer list poisoning, which establishes the preconditions for degrading Monero’s privacy guarantees and undermining network decentralization. To support reproducibility and enable network operators to protect themselves, we release our examination pipeline to identify and block suspicious peers based on newly captured network traffic.