New Tool TorBan Helps Monitor Bitcoin-Over-Tor Attacks

A privacy researcher has created a monitoring tool called TorBan to check for attacks on bitcoin users over Tor.

AccessTimeIconNov 11, 2014 at 6:37 p.m. UTC
Updated Sep 11, 2021 at 11:19 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

Days after researchers described an attack that could reveal the identities of individuals who used bitcoin over the Tor anonymity network, a privacy advocate has developed a tool to monitor the occurrence of that attack.

The tool, TorBan, is a website that gives information about the Tor exit nodes currently connected to the bitcoin network.

If all the connections are fresh, users should be wary of a privacy-invading attack like the one described by the Luxembourg researchers, TorBan's creator Kristov Atlas said, adding:

"If you see a bunch of new nodes never seen before, and all of the ones that have been seen for a long time are no longer seen, that's suspicious."

Atlas said he was inspired to write TorBan by the University of Luxembourg paper, which was written by Ivan Pustogarov and Alex Biryukov, of the university's cryptology research group.

The paper outlined an attack that could unmask a bitcoin user who connected to the digital currency's network using Tor.

Banning Tor networks


The privacy incursion relies on exploiting the bitcoin protocol's built-in protection against denial-of-service (DoS) attacks, which bans clients that it thinks are DoS-ing it. By DoS-ing bitcoin servers from the Tor network, an attacker would cause all Tor exit-nodes to be banned from the bitcoin network.

The attacker can then run their own Tor exit nodes or bitcoin servers, waiting for a victim to connect. Victims are susceptible because they wind up using the attacker's Tor exit-node or her bitcoin server because all legitimate exit-nodes would have been banned by the bitcoin network.

TorBan traces the history of exit-nodes connected to the bitcoin network. If all the nodes are new, it could indicate that a malicious actor has triggered a ban of Tor exit-nodes by bitcoin servers, setting the stage for an attack.

Atlas said he wrote TorBan quickly as a "proof of concept" that the Luxembourg attack could be easily detected.

He added:

"The attack relies on the use of public information. We can use that public information to detect such attacks."

While TorBan doesn't prevent the attack, Kristov pointed out, it can serve as a useful warning system. He said preventing an attack would fall to the bitcoin core developers.

Pustogarov, a co-author of the Luxembourg paper, previously told CoinDesk that the attack could indeed be easily monitored. He welcomed Atlas' work with TorBan, noting that it contributed to a better understanding of the degree anonymity afforded by bitcoin use.

"I can only encourage it. It is a small project designed to detect a very specific attack. But many small projects like this will finally create the big picture," he said.

User identities important for attacks

Painting a clearer picture of anonymity and privacy issues in bitcoin is just what Atlas hopes to achieve with TorBan, which is just one of the programmes running under the Open Bitcoin Privacy Project banner. That's a loose grouping of six software developers working on bitcoin and privacy matters.

Other Open Bitcoin Privacy Project efforts include CoinJoin Sudoku, which evaluates the privacy levels of Blockchain's mixing service SharedCoin, and Open Bitcoin Privacy Library, a framework for analysing privacy on the blockchain.

Atlas underlined the imminent danger of ignoring privacy issues in the bitcoin economy. He said that even though the Luxembourg attack couldn't steal a victim's funds, instead only potentially de-anonymising a bitcoin user, it could still play an important role in a malicious actor's arsenal.

"Every hacker in the world ... builds a profile of their target first. There's an information gathering phase for anyone doing this kind of security work. I think bitcoin privacy is not well protected at the moment; information about where people's assets are and how much they have is really useful information," he said.

Featured image via g4ll4is / Flickr


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.