A large-scale infrastructure anomaly has been detected in Bitcoin's P2P network, potentially indicating covert preparation for a technical attack. Starting April 9, 2026, charts tracking unsolicited network messages (ADDR) showed vertical spikes: the number of fake and unreachable node addresses surged from a baseline of 50,000 per day to over 250,000.
The graphical peak was highlighted by renowned developer and Casa co-founder Jameson Lopp. Some believe that false coordinates may have been deliberately spread across communication channels as part of a preparation for a Sybil attack.
Signs of a covert Sybil attack on Bitcoin
Attackers appear to have chosen a stealthy strategy. Rather than directly attacking block validation or transaction processing, they attempted to rewrite Bitcoin’s “address book”—the list of node addresses exchanged via the ADDR command, enabling new participants to quickly discover peers for synchronization.
Attackers sent hundreds of thousands of fake IP addresses to the network, likely to ensure that newly launched or restarted nodes connect only to non-existent or attacker-controlled "ghost nodes."
If this chart is accurate, it suggests someone is attempting to flood Bitcoin’s P2P network with a large number of fake Bitcoin node addresses—possibly preparing for a Sybil attack? pic.twitter.com/IuWkvkUzjm
— Jameson Lopp (@lopp)May 10, 2026
Theoretically, this strategy could lead to an Eclipse attack, in which a legitimate node is isolated in an information vacuum and can only see the blockchain version provided by the attacker. However, to maintain security and obtain accurate information, the following measures must be taken: blockchain for data, a node needs to establish a connection with at least one honest participant in the network.
Bitcoin client software also automatically distributes connections across different subnets, making it difficult for attackers to monopolize all connection slots within a single IP address pool. Currently, this anomaly appears to cause additional bandwidth load rather than pose a direct threat to consensus itself.
Meanwhile, the market has either not yet priced in the potential risks of such attacks or considers them negligible relative to their possible impact and existing countermeasures. As of writing, Bitcoin is up 0.36%, trading at $81,000 since the start of the new trading day.