Bitcoin Network Flooded With 200,000 'Ghosts', Core Dev Jameson Lopp Warns About Stealth Sybil Attack - U.Today

A large-scale infrastructure anomaly has been detected in Bitcoin’s P2P network, potentially representing hidden preparation for a technical attack. Starting on April 9, 2026, the chart tracking unsolicited network messages (ADDR) showed a vertical spike: the number of fake and unreachable node addresses surged from a baseline of 50,000 to more than 250,000 per day.

The graphical spike was highlighted by well-known developer and Casa co-founder Jameson Lopp, who suggested that someone may be intentionally flooding communication channels with false coordinates as part of preparations for a Sybil attack.

Signs of a stealth sybil attack against Bitcoin

The attacker appears to have chosen a silent strategy. Instead of directly attacking block validation or transaction processing, unknown actors are attempting to rewrite Bitcoin’s “phone book” - nodes exchange each other’s addresses through ADDR commands so that new participants can quickly discover peers for synchronization.

HOT Stories

Ripple’s ‘North Star’ XRP Doubles ETF Inflows Amid Tokenization Breakthrough; SHIB Decouples From Dogecoin; Bitcoin Eyes $94,500 as ‘Sell in May’ Trigger: Bollinger Bands - Morning Crypto Report

Avalanche Founder Warns of Bitcoin (BTC) Crisis

By flooding the network with hundreds of thousands of fake IP addresses, the attacker is probably attempting to ensure that newly launched or restarted nodes connect exclusively to nonexistent or attacker-controlled “ghost nodes”.

In theory, such a tactic could lead to an Eclipse attack, where a legitimate node becomes trapped in an informational vacuum and only sees the version of the blockchain presented by the attacker. However, in order to remain secure and receive accurate blockchain data, a node only needs to establish a connection with at least one honest participant in the network.

Bitcoin’s client software also automatically distributes connections across different subnets, making it difficult for an attacker to monopolize all connection slots from a single IP address pool. At the moment, the anomaly appears to create more parasitic bandwidth load than a direct threat to consensus itself.

The market, meanwhile, either has not yet priced in the potential risk of such an attack or considers it insignificant in the context of the possible impact and existing countermeasures. At the time of writing, Bitcoin was up 0.36% since the start of the new trading session and was trading at $81,000.