# Deanonymisation of clients in Bitcoin P2P network

arXiv: https://arxiv.org/abs/1405.7418 · HTML: https://mlsanity.com/paper/1405.7418/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 May 2014.

## Built on by (most cited first, 5 of 5)

- [GradientCoin: A Peer-to-Peer Decentralized Large Language Models](https://mlsanity.com/paper/2308.10502/) (2023)
- [Demystifying Fraudulent Transactions and Illicit Nodes in the Bitcoin Network for Financial Forensics](https://mlsanity.com/paper/2306.06108/) (2023)
- [You Are What You Write: Preserving Privacy in the Era of Large Language Models](https://mlsanity.com/paper/2204.09391/) (2022)
- [Identifying Ransomware Actors in the Bitcoin Network](https://mlsanity.com/paper/2108.13807/) (2021)
- [Blockchain and Biometrics: Survey, GDPR Analysis, and Future Directions](https://mlsanity.com/paper/2302.10883/) (2023)

## Abstract (arXiv)

Bitcoin is a digital currency which relies on a distributed set of miners to mint coins and on a peer-to-peer network to broadcast transactions. The identities of Bitcoin users are hidden behind pseudonyms (public keys) which are recommended to be changed frequently in order to increase transaction unlinkability. We present an efficient method to deanonymize Bitcoin users, which allows to link user pseudonyms to the IP addresses where the transactions are generated. Our techniques work for the most common and the most challenging scenario when users are behind NATs or firewalls of their ISPs. They allow to link transactions of a user behind a NAT and to distinguish connections and transactions of different users behind the same NAT. We also show that a natural countermeasure of using Tor or other anonymity services can be cut-off by abusing anti-DoS countermeasures of the bitcoin network. Our attacks require only a few machines and have been experimentally verified. We propose several countermeasures to mitigate these new attacks.