A Sybil attack is a security threat where a single entity creates multiple fake identities to gain disproportionate influence over a network or system.
In the context of cryptocurrencies, a Sybil attack typically involves someone running multiple blockchain nodes to manipulate network decisions or disrupt operations.
How Sybil Attacks Affect Blockchains
If an attacker creates enough fake identities, they may be able to out-vote honest nodes on the network. This could allow them to refuse to receive or transmit blocks, effectively blocking other users from the network.
In large-scale Sybil attacks, where attackers manage to control the majority of the network computing power or hash rate, they can then carry out a 51% attack. In such cases, attackers may change the ordering of transactions, prevent transactions from being confirmed, or even reverse transactions they made while in control, potentially leading to double spending.
For example, Bitcoin requires that the ability to create a block be proportional to the total processing power of the PoW mechanism. An attacker must own the computing power required to mine new blocks, which makes attacks costly and difficult to execute. Since mining is resource-intensive, miners generally have a strong incentive to mine honestly rather than attempting a Sybil attack.
Real-World Example and 2026 Developments
In August 2020, an unknown attacker executed three separate 51% attacks on the Ethereum Classic (ETC) network, created after a hard fork of the Ethereum network in 2016. The attacker first carried out a Sybil attack by renting large amounts of hash power and privately mined a secret, longer version of the ETC blockchain while simultaneously depositing millions of dollars worth of ETC onto cryptocurrency exchanges, and swapping them for other coins.
Once the exchange swaps were finalized, the attacker broadcasted the secret longer chain to the public network. Because the protocol follows the longest-chain rule, the network accepted the attacker's chain, overriding the official transaction history in a deep chain reorganization. The attacker's original exchange deposits were erased from history, allowing them to keep the swapped coins and recover their original ETC. Across the three attacks, more than 14,000 blocks were reorganized, resulting in significant double spending.
In 2026, Sybil attacks remain a concern for blockchain networks. Security researchers have noted the emergence of AI-automated Sybil attacks, where autonomous agents can identify and exploit vulnerabilities without direct human involvement. Although the various consensus mechanisms like PoW and PoS can act as defenses, these attacks highlight the importance of robust identity verification and security principles in decentralized networks.