Crypto community scared by unknown entity collecting IP addresses of BTC users

An individual or group of users collects information about Bitcoin transactions and links it to crypto users.

Man holds a Bitcoin coin
LinkingLion has been active since 2018 and is now on Monero's banlist

On March 28, 0xB10C, the pseudonymous developer of Bitcoin analytics websites and, shared with the Twitter community a disturbing blog post about an entity that has been connecting listening Bitcoin nodes or full nodes visible on the network since March 2018.

OxB10C calls the entity LinkingLion, as it uses 812 different IP addresses running through the LionLink network's colocation data center to connect to nodes.

"I suspect this entity is likely tracking transaction propagation to attempt to determine which node broadcasts which transaction to link transactions to IP addresses," the developer said in the post.

Read also: Bitcoin consumed more energy than Sweden last year

According to 0xB10C, "The information the entity learns from a node can be categorized into metadata, inventory, and addresses. All connections learn about the node's metadata, which includes if and when a node is reachable or unreachable, which software version runs on this specific node and when it upgrades, which block height it considers the best and when it changes, and which services the node offers."

Inventory information includes transactions, blocks, and time data, for instance, the time when a particular node announced its new inventory. With this data, the entity can link broadcast transactions to IP addresses.

Finally, the research conducted by 0xB10C has revealed that about 2% of the connections LinkingLion makes ask nodes for other network addresses that can be used as potential targets for new connections.

Some Twitter users believe LinkingLion may be, an analytics platform that searches for all reachable Bitcoin nodes to estimate the relative size of the network.

However, 0xB10C believes this may not be the official version of Bitnodes. "The IP addresses are listed on their site, they use a user agent like / and use an older Bitcoin protocol version. Could be someone else running a modified version though," 0xB10C has commented on this possibility.

Although the developer believes that LinkingLion is in all likelihood a blockchain analytics company, many Twitter users are concerned about the potential threat to their privacy. Others also fear that this company might seek ways to take over the chain. Considering the large number of different Bitcoin addresses used by the entity, it is easy to imagine that it is striving to gain power over the network.

To protect oneself from tracking, 0xB10C suggests Dandelion++, a proposed transaction relay protocol that first transmits transactions to another node and then broadcasts the transaction.

One of the Twitter users, Sankta Gralo, has described a truly dystopian scenario about the future of Bitcoin when the ratio between mining rewards and costs gets closer to 1:1. According to Gralo, crypto users will have to look for alternative ways to make Bitcoin valuable.

Gralo believes, that at this point, the law of supply and demand could be put into practice. According to this law, a shortage of goods increases the demand for them, which in turn makes the price of those goods grow. Since people cannot directly manipulate the number of Bitcoins in the system, they could try to reduce the number of tradable coins, which would decrease the supply.

Read also: Bitcoin is the dirtiest crypto, far ahead of other currencies

"As the access to your BTC stays primarily in your head, and there is no way to take it, out by force (yet), it may happen either by somehow cutting off the hodlers' access to the BTC system (rather unlikely to happen) or by taking off the hodlers, so their coins are frozen forever, just like all the so-called "lost coins" right now. In this case, there will be only so many accessible coins left. So the actual, "tradable supply" will decrease and the price in USD will still go up," Gralo made a rather gloomy prediction and warned Bitcoiners to be especially careful about their privacy.

Meanwhile, on March 22, Twitter user Matthias Grundmann shared another suspicious activity on the Bitcoin network with the crypto community.

"Our Bitcoin Monitoring shows that yesterday about 500 new peers joined the #Bitcoin P2P network. As all of them joined within a very short time and are hosted in just two different networks, it looks like they are Sybil peers controlled by the same party," Grundmann tweeted.

According to some users, it could have been an attempt to perform an attack, while others believe it could have been a zero-configuration processor that can automatically create a usable computer network.