Validator Anonymity
The P2P network still has a privacy issue
Yann Vonlanthen · Ethereum Foundation
Who runs which validator?
runs a validator
?
?
?
?
?
?
?
?
?
?
?
On chain
validator 93
?
On the network
203.0.113.7
Why does anonymity matter?
slot n−1
slot n
slot n+1
V7
V7 runs here
DoS
offline
+ MEV
+ votes
Our 2024 talk:
“The proposer of slot n+1 could snipe the rewards of the proposer of slot n.”
“Finality might be impacted.”
64 subnets
subnet 37
subnet 62
subnet 5
My vote is for subnet 5
5
Every validator votes once per epoch, every 6.4 minutes
64 subnets: each node forwards only 2 of them
One hop into the right subnet, then gossip
Do we give up privacy for lower network load?
Listening to everything
our node
I am in all subnets!
a peer
?
13
14
13
14
13
13
14
14
7
57
61
V93
V93
V93
V93
Its two subnets: 13 and 14
And now and then: 7, 57, 61 …
Outside its two subnets, it only sends its own validator’s votes
One peer, one evening
Every message
from one peer
The band: its
two subnets
Red: one
validator
once per epoch,
any subnet
Four of them.
All on this peer.
Our measurement, 6 May 2024 · Heimbach, Vonlanthen, Villacis, Kiffer, Wattenhofer, USENIX Security 2025
4 nodes, 3 days
Frankfurt
Seoul
Virginia
Zurich
161,057
validators located · more than 15 % of all
EF bug bounty
May 2024 · Heimbach, Vonlanthen, Villacis, Kiffer, Wattenhofer, USENIX Security 2025
Few machines
19,390
validators on one machine
a large staking pool
Few clouds
~90 %
of located validators
run in the cloud
Amazon alone: 19 %
A few hundred machines
could stall finality.
2024
An attacker could
snipe a proposer’s rewards
stall finality
2026
With numbers
KnockBlock: +44.5 % MEV
StakeBleed: ~300 ETH in 2 h
Doumanidis & Apostolaki, Princeton
Financial Cryptography 2026
Find, hijack, exploit
Routing Attacks in Ethereum PoS · Doumanidis & Apostolaki · FC 2026
1
Find
Every validator,
to its IP prefix
2
Hijack
Steal the route
to that prefix
3
Exploit
StakeBleed
KnockBlock
The host speaks first
Their SuperNode times every vote that is pushed to it eagerly
0 s
1 s
2 s
3 s
4 s
slot start
time after slot start, for one validator’s vote
the host: first, epoch after epoch
Schematic · Doumanidis & Apostolaki, FC 2026, §4.1
From a seed to everyone
Seed
consecutive IDs
share a prefix
(50 % of validators)
Clean
same deposit key
same hosting AS
for training
Learn
timing classifier
91 % accurate
Map
1,063,660
validators, to
4,600 prefixes
Data: Nov 2024 to Jan 2025 · Doumanidis & Apostolaki, FC 2026, §4.2
From 15 % to everyone
2024 · our subnet trick
161,057
IP addresses · blind to nodes in all 64 subnets
2026 · timing
1,063,660
IP prefixes · classifier 91 % accurate
Joining all 64 subnets no longer hides you.
Where both studies overlap with high confidence, they agree on 70 % · Doumanidis & Apostolaki, FC 2026
Validators live in few places
4,600 prefixes host all validators
29
prefixes hold
a third of all
validators
Three hosting networks hold more than half · OVH alone ~27 %
Hijacking a route
rest of Ethereum
AS
AS
203.0.113.0/23
hosting provider
attacker
I have 203.0.113.0/24
The most specific route wins
Traffic flows to the attacker, who drops it
40.85 % of Ethereum nodes: no proper RPKI protection
Undoing a hijack: 2 to 3 hours, by hand
StakeBleed
0
1 h
2 h
hijack 30 prefixes
More than 1/3 of the stake is cut off
inactivity leak, no finality
after 4 epochs, 26 min
287 ETH in 2 hours
110.6 ETH
penalties, cut off
61.8 ETH
missed rewards, cut off
114.8 ETH
everyone else
35 % of stake cut off
40 % of the loss hits validators
that were never cut off
Doumanidis & Apostolaki, FC 2026, §3.2 and §6 · 1,063,660 validators · even without a leak, 20 % cut off for 2 h costs 214 ETH
KnockBlock
slot n−1
slot n
slot n+1
V7
Schedule known 12.8 min ahead
< 2 min
one prefix hijacked, for one slot
+44.5 % MEV
on average, in the block after a missed slot
Pays off from 4 validators.
2024: could · 2026: +44.5 %
Doumanidis & Apostolaki, FC 2026, §3.3 and §7 · break-even assumes ~$2,500 a year to run an AS
Since 2024
new leak
Nodes advertise their stake
Fulu, Dec 2025: ENR field cgc, stake / 32 ETH
cgc
4
no validators
cgc
8
some stake
cgc
64
~2,048 ETH
in state
Proposers fixed 2 epochs ahead
Fulu: lookahead in the state (EIP-7917) · Whisk: stagnant
unchanged
Still 2 of 64 subnets per node
The subnet trick still works
consensus-specs: fulu/validator.md, fulu/p2p-interface.md (cgc), phase0/p2p-interface.md (SUBNETS_PER_NODE) · EIP-7917 Final, EIP-7441 Stagnant
Our 2024 question
Do we give up
privacy for lower
network load?
Better trade-offs
Remove the signal
Spend the bandwidth dividend
Hide in your own subnet (DC)
Vote through a throwaway relay
Keep roles secret
Make isolation hard
Noise doesn’t hide you
Their mapping model
93 %
+ random delays, 50 to 500 ms
90 to 92 %
No eager push, no out-of-subnet votes
38 %
Remove the signal. Noise is cheap to filter out.
Doumanidis & Apostolaki, FC 2026, §8
Spend the bandwidth dividend
Inbound MiB per hour, one mainnet node
2 subnets
default
609
control 35 %
votes 57 %
all 64
opt-in flag
5,601
9.2×
to join all 64 subnets
all 64
compressed
3,041
Stream compression:
−46 %
Beats the subnet trick.
Not timing.
Nashatyrev, “Snappy with a memory”, ethresear.ch, Sep 2026 · Teku on mainnet, ~45 peers · compression: 1 MiB history
Hide in your own subnet
Today
13 · 14
my node
13
14
7
my validator’s vote
Stands out
DC proposal
13 · 14
my node
13
14
13
my validator’s vote
Looks like relaying
Validators keep their committee and subnet. Cost: +1.90 Mbit/s per subnet, vs 0.55 today
Hides from the subnet trick, not from timing
dc-networking: properties.md (anonymity enhancing), staggered-committees/analysis/network.md §4 · model: 1M validators, kappa = 7
Never fill a committee alone
Contiguous indices: one operator fills the committee
one aggregate,
first from one peer
Mapped in one observation: exact and free
32 to 93 %
of an operator’s validators
in committees it fills alone
Strided or era-shuffled: every committee mixed
Same schedule, at most one reshuffle a day
dc-networking: staggered-committees/analysis/network.md · deposit batches of 1,000 to 10,000 validators
Hide each message?
SPREAD, per message
100
150
200
0 %
25 %
50 %
mean latency, ms
attacker accuracy
GossipSub: 38 %
30 %, and faster than GossipSub
Dandelion-level: 11 %
But votes repeat every epoch
0
10
21
0 %
50 %
100 %
epochs of the same validator voting
99 % after 21 epochs
20 % per vote
Worth it for one-shot messages: blocks, inclusion lists. Not for votes.
SPREAD, ethresear.ch 25343, Jul 2026: simulation, 10 % curious nodes · right: 5 % curious nodes, 20 % per vote, from a reply in that thread
Vote through a throwaway relay
Make finding the sender worthless
gossip and subnets
private link
my node
keys and stake stay here
relay
cheap, disposable
found: the relay
still hidden
DoS
relay
new relay, fresh IP
128 aggregators
point to point, no gossip
All your votes leave through a cheap relay
Deanonymize it: you find the relay, not the node
DoS it: you miss a vote, then spawn a new one
Votes can skip gossip: straight to 128 aggregators, Wonderboom-style
Close to the paper’s temporary proxy nodes (Doumanidis & Apostolaki §8) · Wonderboom, arXiv 2602.06655 · dc-networking open question P4
Throwaway relays: the catch
The node still leaks
Since Fulu its ENR shows
its stake (cgc): StakeBleed
can still find its prefix.
Relays are re-found
A new relay’s first votes
map it again. Each respawn
costs missed votes.
Proposals need more
A known relay can be DoSed
in your slot: use a fresh one.
Builder API calls leak too.
Aggregators exposed
Direct sending needs known,
reachable aggregators, and
128 copies of every vote.
Who gets in?
Fresh relays have no peer
score: floods are cheap.
Needs PoV or per-vote checks.
Trust and clouds
A shared relay sees, and can
drop, your votes. Cheap relays
crowd into a few clouds.
“Partial protection is no protection.”
ethresear.ch 21050, Nov 2024, on Builder API registrations
Keep roles secret
slot 1
V7
?
slot 2
V93
?
slot 3
V12
?
slot 4
V4
?
slot 5
V55
?
slot 6
V31
?
Public schedule: the KnockBlock target list
Whisk (SSLE): stagnant. Fulu made the lookahead public state
Fresh validator keys every day: SSLE almost for free
DC: secret duties via VRF, +96 B per vote
EIP-7441 (Stagnant), EIP-7917 (Final) · Buterin, “The Extremely Lean Chain”, ethresear.ch, Jul 2026 · dc-networking network.md §4
Make isolation hard
Sign your routes (RPKI)
Spread across providers
Detect a hijack, move automatically
Operators can do this today.
40.85 %
of Ethereum nodes lack proper
RPKI protection
OVH alone: ~27 % of validators
Three ASes: more than half
Doumanidis & Apostolaki, FC 2026, §3.1, §5, §8
Anonymity is a
security property.
Protocol: stop leaking signals
DC: own subnet, never alone
Operators: sign routes, spread out
Thanks!
@yannvon
Heimbach, Vonlanthen, Villacis, Kiffer,
Wattenhofer · USENIX Security 2025
Doumanidis & Apostolaki · FC 2026
Appendix
For Q&A
Which peers we could read
deanonymized
no validators
all 64 subnets
unclear
Frankfurt
47 %
44 %
9 %
Seoul
44 %
44 %
12 %
Virginia
59 %
33 %
7 %
Zurich
58 %
33 %
7 %
Overall
52 %
38 %
9 %
Peers with long connections (> 32 epochs), 4,372 in total · Heimbach et al., USENIX Security 2025
Our heuristic: v runs on p if
C1
At least 90 % of the expected non-backbone votes of v arrive from peer p
C2
p is not subscribed to all 64 subnets
C3
We receive at least every tenth vote we expect for v from p
C4
v’s vote count from p is one standard deviation above p’s mean per validator
Conservative on purpose: we only label peers we saw long and well enough.
Heimbach, Vonlanthen, Villacis, Kiffer, Wattenhofer, USENIX Security 2025, §4
Validators per machine
27 %
of peers host a single validator
> 50 %
host at most 4
11 %
host more than 100
709
per machine on average, five largest pools
19,390
on a single machine
Operators split validators in round numbers: 100, 250, 300, 350, 400, 500, 1,000
StakeBleed, in numbers
11,072 Gwei
average reward per validator per epoch, without attack
4 epochs
cut off before the inactivity leak starts, ~26 min
287 ETH
35 % cut off for 2 h: 110.6 penalties + 61.8 missed + 114.8 others
214 ETH
20 % cut off for 2 h, no leak
> 125 ETH
per epoch lost by the connected validators during a leak
~3 weeks
of leak until a 32 ETH validator is ejected at 16 ETH
Doumanidis & Apostolaki, FC 2026, §3.2, §6 · validator set of 1,063,660
KnockBlock, in numbers
12.8 min
proposer schedule known in advance (2 epochs)
< 90 s
for a BGP announcement to take effect
+44.5 %
MEV on average after a missed slot
+453.6 %
proposer reward at most, from the extra votes
0.19 ETH
extra per validator per year
> 3
validators to cover ~$2,500 a year for an AS
Doumanidis & Apostolaki, FC 2026, §3.3, §7
SuperNode, in numbers
Eager only
keeps votes pushed directly, not ones fetched after IHAVE
Out-of-subnet
our 2024 signal, used as an extra feature
41 h
until 60 % of peers are done (disconnect once all validators seen)
20×
fewer resources than fixed-length connections
91 %
classifier accuracy on held-out data
70 %
agreement with our 2024 mapping, high-confidence overlap
Doumanidis & Apostolaki, FC 2026, §4 · data Nov 2024 to Jan 2025
Where validators sit, late 2024
4,600
prefixes host all 1,063,660 validators
60 %
in 100 prefixes
37,000
validators in the largest prefix
> 80 %
in 20 ASes, out of 1,057 used
37 %
of validators in the US (31 % of nodes)
~90 %
of stake in 12 countries
Data Nov 2024 to Jan 2025 · Doumanidis & Apostolaki, FC 2026, §5
Which fix blunts which attack
Subnet trick
Timing
StakeBleed
KnockBlock
All 64 subnets
Own subnet (DC)
No single-operator committees (DC)
No eager push, no out-of-subnet
Per-message anonymity (SPREAD)
Throwaway vote relay
Secret roles (SSLE, VRF, daily keys)
RPKI, diversity, failover
My reading of the sources on the previous slides; filled = blunts it, empty = does not