0xB10C: Someone is trying to deanonymize the addresses of all bitcoin-wallets – Bits Media

According to the developer of the Bitcoin network application under the pseudonym 0xb10c, The confidentiality of the personal data of the owners of BTC-wallets is under threat.

Private person or group, United under the name LinkingLion collects data on the owners of bitcoins from Martha 2018 year and already used(-oval) more 800 various IP addresses, to hide your activity, tells 0xb10c.

LinkingLion sets a Bitcoin oster TCP connection and triggers the version confirmation, Sending a message: version. Messages about the version have unclear user agents, such as, eg, /bitcoinj:0.14.3/Bitcoin Wallet:4.72/, /Classic:1.3.4(EB8)/or / satoshi:0.13.2/. In total, Linkinglion used 118 various user agents. Almost all of them appear in messages about the version with the same frequency. That is, user agents are selected from the list and, probably, are fake.

“Linkinglion opens connections with many nodes of the bitcoin network, using four IP address ranges, and listens to transactions. Uses IP addresses of three IPV4/24 ranges and one IPV6/32 range to connect to listening nodes on the Bitcoin network. This can allow Linkinglion to connect new broadcast transactions with the IP addresses of the nodes. This behavior may indicate that, that unknown/ny is trying to determine, Is a specific node available for a specific IP address. All these ranges of IP addresses are declared AS54098, LionLink Networks», - writes 0xb10c.

Based on the information of the ARIN and RIPE registry, The ranges belong to different companies: Fork Networking, Castle VPN, Linama UAB и Data Canopys.

Fork Networking and Castle VPN are American companies, belonging to the same owner. Fork Networking offers hosting and bell services, And Castle VPN-VPN provider. Linama UAB - Lithuanian company, unprofitable. Data Canopy - American company, Data processing cloud and bell centers. Since the connection from these ranges of the IP addresses have very similar behavior, 0XB10C suggested, that they are controlled or rented by linkinglion.

Approximately in 15% LinkingLion cases do not immediately close the connection. Instead, either listens to inventory messages, containing transactions, either sends a request to the address and listens as an inventory messages, so targeted messages. Then closes the connection within ten minutes.

Information, which Linkinglion receives from the node, can be divided into metadata, Inventory and addresses. All connections will learn about the metadata node, which include information about, when the knot is available or inaccessible, Which version of the software works on this particular node and when it is updated, what height of the block considers the best and when it changes, What services does the node offer.

0XB10C suggested, that in this way, Linkinglion can record transactions synchronization, to determine, which knot was the first to receive a transaction. Then this information can be used to determine the IP address, associated with specific bitcoin addresses. According to 0xb10c, LinkingLion can use this information to bind broad-Prophetic transactions directly to IP addresses.

0XB10C proposes to protect the community from the threat of theft of confidential data by creating a list of open source prohibitions, which nodes can use, To close for LinkingLion the ability to connect. However, 0xb10c draws the attention of developers, that LinkingLion can try to get around the prohibition list, Changing the IP address, which is currently using to connect. Short-term prevention may be a manual ban on IP address ranges, used LinkingLion for incoming connections to nodes. According to 0xb10c, The only constant solution to the problem may be a change in transactions logic in Bitcoin Core.

According to the report "Kaspersky Laboratory" for 2022 year, The company recorded
almost 200 000 Attempts to steal the data of cryptocurrency wallets and accounts of crypto investors.