Deanonymizing Ethereum Validators: The P2P Network Has a Privacy Issue#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Wildcard pick 13–15 August 2025
Lioba Heimbach et al., ETH Zurich; University of Bern; IMDEA Networks — Wildcard
- Why: Not a blockchain-economics paper — a peer-to-peer network privacy/deanonymization finding (any node can link validator identities to peer IP addresses) that's really a P2P protocol design lesson wearing blockchain clothing, relevant to anyone reasoning about identity-unlinkability guarantees in P2P systems generally.
- What: Demonstrates the Ethereum P2P network fails to provide its intended validator anonymity — any participating node can link a validator's identifier to a peer's IP address. Using data from just four nodes over three days, the authors located 15%+ of all Ethereum validators, including geographic location and hosting organization. Awarded a bug bounty by the Ethereum Foundation. (from abstract only)
- How: A methodology for any P2P node to correlate validator identifiers with connected peers' network-level metadata, empirically validated at scale rather than theorized. (from abstract only)
- Where applicable: Directly Ethereum-specific in its finding, but the underlying lesson — that P2P protocols claiming participant anonymity need explicit defenses against peer-correlation attacks, not just identifier obfuscation — generalizes to any P2P system with an unlinkability goal.