<p>An <em>eclipse attack</em> is when most (if not all) of your peers are malicious and they basically prevent you from being well-connected to the network to obtain information about transactions you're interested in. An eclipse attack is particular useful when a payer has sent some bitcoins to you in some transaction, then decides to also doublespend the same bitcoins. The doublespender (or payer) will use the <em>eclipse attack</em> to prevent you from knowing that there is also a doublespend transaction out in the open, so you get misled into believing that there's only the original transaction. </p>

<p>A <em>sybil attack</em> on the other hand is where a malicious actor is trying to spam the network with nodes that they control attempting to subvert the network's reputation system. For example, false signalling of support using version bits.</p>

<p>To summarise, an <em>eclipse attack</em> is targeted at a single party; whereas a <em>sybil attack</em> is network targeted. In the context of bitcoin, a <em>sybil attack</em> is not particularly harmful since all nodes operate based on consensus rules and any deviation will lead to said node getting DoS banned.</p>

CC BY-SA 3.0
2018-03-20T00:30:15.647Z
I think it's worth pointing out that in the Bitcoin and cryptocurrency space, the term "Sybil attack" was traditionally used for both actual Sybil attacks and what is now known as eclipse attacks, due to there not really being a good term for the second until it was introduced by the paper referred to by OP.
Pieter Wuille
CC BY-SA 3.0
2017-10-23T01:23:58.510Z
2018-03-20T00:21:43.553Z
2018-03-20T00:21:43.553Z
rny
<p>In a sybil attack, the attacker impersonates multiple identities. </p>

<p>In an eclipse attack, the attacker eclipses a victim from the network. That means the attacker basically controls which information the victim is able to send to the network and vice versa. </p>

<p>I would therefore say that a sybil attack is what an adversary uses in order to perform an eclipse attack. This is because a Bitcoin node normally connects to multiple peers. The adversary therefore would have to impersonate all peers of the victim in order to eclipse the victim from the rest of the network. </p>

CC BY-SA 4.0
2019-03-26T14:44:45.117Z
FWIW, the Bitcoin wiki [still refers to eclipse attacks as Sybil attacks](https://en.bitcoin.it/wiki/Weaknesses#Sybil_attack).
Paul d'Aoust
CC BY-SA 3.0
2017-10-23T11:55:09.703Z
2017-10-23T11:55:09.703Z
greenphone
<p>I came across this paper <a href="https://eprint.iacr.org/2015/263.pdf" rel="noreferrer">Eclipse Attacks on Bitcoin’s Peer-to-Peer Network ∗</a> that sounds very similar to the Sybil attack.</p>

<p>Can someone point out the difference between both attacks.</p>

<sybil-attack><eclipse-attack>
Eclipse attack vs. Sybil attack
user123
# Eclipse attack vs. Sybil attack

(Asked by: username_0 on 2017-10-22)

I came across this paper [Eclipse Attacks on Bitcoin’s Peer-to-Peer Network ∗](https://eprint.iacr.org/2015/263.pdf) that sounds very similar to the Sybil attack.

Can someone point out the difference between both attacks.

**Tags:** sybil-attack, eclipse-attack


---

## 2 answers

### Answer by username_1 on 2017-10-23. Score: 15

An *eclipse attack* is when most (if not all) of your peers are malicious and they basically prevent you from being well-connected to the network to obtain information about transactions you're interested in. An eclipse attack is particular useful when a payer has sent some bitcoins to you in some transaction, then decides to also doublespend the same bitcoins. The doublespender (or payer) will use the *eclipse attack* to prevent you from knowing that there is also a doublespend transaction out in the open, so you get misled into believing that there's only the original transaction.

A *sybil attack* on the other hand is where a malicious actor is trying to spam the network with nodes that they control attempting to subvert the network's reputation system. For example, false signalling of support using version bits.

To summarise, an *eclipse attack* is targeted at a single party; whereas a *sybil attack* is network targeted. In the context of bitcoin, a *sybil attack* is not particularly harmful since all nodes operate based on consensus rules and any deviation will lead to said node getting DoS banned.

> **Comments:**
> **username_2**: I think it's worth pointing out that in the Bitcoin and cryptocurrency space, the term "Sybil attack" was traditionally used for both actual Sybil attacks and what is now known as eclipse attacks, due to there not really being a good term for the second until it was introduced by the paper referred to by OP.  

---

### Answer by username_3 on 2017-10-23. Score: 2

In a sybil attack, the attacker impersonates multiple identities.

In an eclipse attack, the attacker eclipses a victim from the network. That means the attacker basically controls which information the victim is able to send to the network and vice versa.

I would therefore say that a sybil attack is what an adversary uses in order to perform an eclipse attack. This is because a Bitcoin node normally connects to multiple peers. The adversary therefore would have to impersonate all peers of the victim in order to eclipse the victim from the rest of the network.

> **Comments:**
> **username_4**: FWIW, the Bitcoin wiki [still refers to eclipse attacks as Sybil attacks](https://en.bitcoin.it/wiki/Weaknesses#Sybil_attack).  

---

