Is this anon identifying Bitcoin wallets through IP addresses?

An anonymous ‘entity’ that has been opening connections to Bitcoin nodes and listening to transaction announcements is likely a corporation performing some kind of blockchain analysis, according to pseudonymous Bitcoin app developer 0xB10C.

In a blog post published on Tuesday, 0xB10C detailed how the unknown individual or group (dubbed ‘LinkingLion’ because the IP addresses associated with it pass through LionLink network’s data center) appears to be trying to collect IP addresses of Bitcoin users and link them to their BTC addresses.

According to 0xB10C, it does this by using 812 IP addresses to open connections with nodes and ask what Bitcoin software they’re using. When it receives a version number, 82% of the time it ceases contact. However, in the remaining 18% of cases, as detailed by 0xB10C, it listens for inventory messages containing transactions or requests an address.

0xB10C claims that this may be because it’s trying to find out if a node is reachable at a specific IP address. If this is what the entity is up to, as outlined by Cointelegraph, it may be “recording the timing of transactions to determine which node first received a transaction, information that can then be used to determine the IP address associated with a particular Bitcoin address.”

Read more: Bitcoin Core developer proposes new type of pruned node

Who’s behind this?

As detailed by 0xB10C’s post, the majority of Bitcoin P2P anomalies can be traced back to individuals playing around with the open network, companies looking to make money by selling data to other firms, law enforcement, or academic researchers.

While it’s impossible to know for sure what’s happening in this particular case, 0xB10C does have a number of theories. According to the anonymous developer, it’s unlikely that an individual would sustain this kind of behavior over multiple years (LinkingLion has been active since 2018) due to the fact that the IP address ranges and servers cost money. It’s also unlikely to be an academic experiment, they argued because papers need to be published at some point.

So, reasons 0xB10C, it makes most sense for a company performing blockchain analysis to be behind the activity. After all, it may be worth paying for said IP addresses and servers if a firm can either sell on collected data or use it to enhance its existing product.

Protos has reached out to 0xB10C for further details and we’ll update this piece if we receive a reply.

For more informed news, follow us on Twitter, Instagram, and Google News or subscribe to our YouTube channel.