Routing Attacks on Cryptocurrency Mining Pools

Routing Attacks on Cryptocurrency Mining Pools

Speakers: Muoi Tran, Postdoctoral Researcher; Theo von Arx, PhD Student; Laurent Vanbever, Professor

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=Oe8Uj-HWceo

Overview

This talk, "Routing Attacks on Cryptocurrency Mining Pools," delivered by Muoi Tran, Theo von Arx, and Laurent Vanbever at IEEE S&P, unveils a critical vulnerability in the infrastructure supporting modern cryptocurrencies. The presentation meticulously details how cryptocurrency mining pools, which are essential for the operation and security of most proof-of-work blockchains, are highly susceptible to routing attacks. Specifically, the researchers demonstrate how malicious actors, by leveraging well-known BGP hijacking techniques, can disrupt mining operations on a massive scale. The core innovation of this work lies in identifying a novel stealth attack vector enabled by a previously undiscovered vulnerability within Stratum V2, the next-generation mining pool protocol.

The significance of this research cannot be overstated. Mining pools now account for over 99% of new Bitcoin blocks and a substantial majority across other top proof-of-work cryptocurrencies, making them central to the integrity and reliability of these digital economies. A successful, stealthy attack on these pools could lead to significant financial losses for miners, undermine confidence in the stability of cryptocurrencies, and potentially enable more severe follow-up attacks like double-spending. The ability to disrupt a large percentage of a cryptocurrency's mining power without immediate detection poses an existential threat, highlighting the urgent need for enhanced security measures in the underlying network infrastructure and communication protocols.

This talk serves as a critical warning to the cryptocurrency community and network operators alike, providing not only a deep technical analysis of the attack mechanisms but also practical, actionable mitigations. It underscores the often-overlooked interplay between low-level network routing protocols and the high-stakes world of decentralized finance, arguing for a more holistic approach to securing critical digital services.

Background

▶ Watch: Introduction: The critical role of mining pools (0:00)

The stability and security of proof-of-work (PoW) cryptocurrencies like Bitcoin fundamentally rely on a vast, distributed network of miners competing to solve complex computational puzzles. Fifteen years ago, individual miners could reliably find blocks and earn rewards. However, with increasing network difficulty, this is no longer feasible for most. To increase their chances of earning consistent rewards, individual miners now aggregate their computational power into mining pools. These pools consist of numerous miners, each running dedicated hardware, coordinated by one or more central servers. The pool's server distributes "jobs" (block templates) to miners, who then submit "shares" (partial solutions) back to the pool. When a miner finds a valid block, the pool submits it to the blockchain, and rewards are distributed among participants based on their contributed shares. As highlighted in the talk, mining pools now create over 99% of new Bitcoin blocks and the vast majority in other top 10 PoW cryptocurrencies, making them indispensable infrastructure.

Despite their critical role, the communication channels between mining pools and individual miners are often vulnerable. The public internet, comprising nearly 80,000 Autonomous Systems (ASes), is the medium through which this traffic flows. A significant threat model in this environment is BGP hijacking, a technique where an attacker manipulates the Border Gateway Protocol (BGP), the routing protocol that governs how data travels across the internet. An adversary controlling even a single malicious AS can advertise false routing information, diverting traffic intended for a legitimate destination to themselves.

Historically, BGP hijacking attacks have taken several forms:

1. Origin Hijack: The attacker AS advertises itself as the legitimate origin or owner of an IP prefix (e.g., a /24 block) that hosts a target server. This misdirection causes routers to send traffic for that prefix to the attacker.
2. Sub-prefix Hijack: Attackers advertise a more specific (i.e., longer) prefix (e.g., a /25 instead of a /24) that is contained within the target's legitimate prefix. Due to BGP's longest-prefix-match rule, routers prioritize the more specific route, sending traffic to the attacker.

To counter these attacks, two primary defenses have been developed:

1. Resource Public Key Infrastructure (RPKI): This cryptographic framework allows legitimate ASes to associate themselves with the IP prefixes they are authorized to advertise. Routers that validate RPKI can then filter out unauthorized advertisements, preventing many origin hijacks. The research found that 93% of surveyed mining pool servers were protected by RPKI, indicating awareness of this threat.
2. Max-length Prefix Advertisements: To mitigate sub-prefix hijacks, ASes can advertise the longest possible prefix they own, making it harder for an attacker to advertise an even more specific prefix without being noticed or filtered. However, the survey revealed that only 52% of mining pool servers were protected by max-length prefixes, leaving a significant portion vulnerable.

Despite these defenses, the talk argues that existing BGP hijacking techniques, specifically for-origin hijacking and sub-prefix hijacking, can still bypass them. A for-origin hijack involves the attacker advertising the legitimate AS as the origin in the BGP path, but placing their own AS in front, effectively creating a valid-looking path that still intercepts traffic. This bypasses RPKI, which primarily validates the origin AS, not the entire path. These routing vulnerabilities, combined with the centralized nature of mining pools, create a fertile ground for sophisticated attacks, leading to the discoveries presented in this work.

Key Findings

▶ Watch: How adversaries perform BGP hijacking attacks (3:30)

The research presents several critical findings that collectively expose a new and highly effective attack vector against cryptocurrency mining pools:

1. Widespread Vulnerability to Routing Attacks: A comprehensive survey of 55 active mining pools across the top 10 proof-of-work cryptocurrencies revealed that 91% (50 pools) have publicly identifiable pool server IP addresses, making them potential targets. Despite 93% of these pools utilizing RPKI for origin validation, a significant 48% (those not using max-length prefix advertisements) remain vulnerable to sub-prefix hijacking. Furthermore, all RPKI-protected pools are still susceptible to for-origin hijacking, effectively bypassing current routing security measures. This demonstrates that routing-based interception is a practical and widespread threat.

1. Discovery of a Stealthy Attack Mechanism via Stratum V2 Vulnerability: The most impactful finding is the discovery of a critical vulnerability in Stratum V2, the next-generation mining pool protocol designed to replace the unencrypted Stratum V1. Stratum V2 incorporates authenticated encryption with associated data (AEAD) and uses independent nonce counters on both the sender (pool) and receiver (miner) sides for encryption and decryption. The vulnerability arises from how Stratum V2 handles decryption errors. If a packet is corrupted during transit (e.g., by an attacker), the receiver cannot decrypt it, and its nonce counter remains unchanged. However, the sender, having successfully transmitted the packet from its perspective, increments its counter. This leads to nonce counter desynchronization. Subsequent messages become undecryptable, effectively severing the communication and preventing mining progress.

1. Achieving Stealth and Persistence with Minimal Tampering: This Stratum V2 vulnerability enables a highly stealthy attack. Instead of dropping all intercepted packets (which is easily detectable due to high packet loss and long-term BGP hijacking visibility), the adversary only needs to tamper with a single packet in each intercepted connection. This subtle interference triggers the nonce desynchronization, persistently disrupting the connection. Short-term, intermittent BGP hijacks required for single-packet tampering are common on the internet due to misconfigurations, making them difficult to distinguish from legitimate network anomalies. This significantly reduces the chances of detection by network operators or security investigators.

1. Misattribution of Attack Effects: The effects of this stealthy attack—miners submitting rejected shares or experiencing no mining progress—are easily misattributed. Miners might suspect the pool is cheating or stealing rewards, while pools might attribute issues to miner hardware failures or miners switching to other pools. This lack of trust and difficulty in diagnosing the root cause allows the attack to remain "under the radar" for extended periods, making it fundamentally difficult to trace back to a routing-level intervention.

1. Large-Scale Disruption Capability: The research quantifies the potential impact of these attacks on the Bitcoin network. It reveals that almost all Autonomous Systems (ASes) on the internet possess the capability to disrupt up to 45% of Bitcoin's total mining power. Furthermore, over 1,300 different ASes could disrupt more than half of Bitcoin's mining power. In a particularly striking example, a single powerful AS like Cloudflare was found capable of disrupting up to 96% of the entire Bitcoin mining power. This demonstrates the potential for catastrophic, large-scale disruption, which could be leveraged for follow-up attacks against blockchain consensus, such as double-spending.

These findings collectively highlight a severe security gap, where the foundational routing infrastructure of the internet can be exploited to silently undermine the operational integrity of critical cryptocurrency services, necessitating immediate and comprehensive mitigation strategies.

Technical Deep Dive

▶ Watch: Bypassing RPKI with forged origin hijacking (5:00)

The attack described in this talk hinges on a sophisticated combination of well-understood network routing vulnerabilities and a newly discovered protocol-level flaw in Stratum V2. The technical details can be broken down into the interception mechanism and the stealthy disruption mechanism.

Interception Mechanism: BGP Hijacking and its Bypasses

The initial step for the adversary is to intercept traffic between a mining pool server and its miners. This is achieved through BGP hijacking, exploiting the trust-based nature of the Border Gateway Protocol.

1. Identifying Targets: The researchers surveyed 55 active mining pools in the top 10 PoW cryptocurrencies and found that 50 (91%) had publicly accessible pool servers with identifiable IP addresses, making them vulnerable to targeting.

1. Origin Hijack: The most basic form of BGP hijacking. An adversary (e.g., AS66) advertises a BGP message claiming to be the legitimate origin (AS10) of an IP prefix (e.g., /24) hosting the pool server. Routers that receive this bogus advertisement would then direct traffic for that prefix to AS66.

• Defense and Bypass: Resource Public Key Infrastructure (RPKI) was designed to combat origin hijacks. Under RPKI, AS10 would cryptographically sign an attestation (a Route Origin Authorization, or ROA) stating that it is authorized to advertise its /24 prefix. Routers performing RPKI validation would filter AS66's unauthorized advertisement. The survey showed 93% of pool servers were RPKI protected.
• For-Origin Hijack Bypass: The researchers found that RPKI, while effective against pure origin hijacks, can be bypassed by a for-origin hijack. In this technique, the adversary (AS66) sends a BGP message that includes the legitimate origin AS (AS10) in the AS path, but places AS66 in front of it (e.g., AS66, AS10). Since RPKI primarily validates the origin AS (the last AS in the path), this advertisement appears legitimate to RPKI-validating routers, allowing AS66 to intercept traffic. This means that even RPKI-protected pools are vulnerable to this sophisticated form of hijacking.

1. Sub-prefix Hijack: This attack exploits the longest-prefix-match rule of IP routing. If a pool server is hosted on a /24 prefix, an attacker can advertise a more specific /25 prefix that falls within the /24. Internet routers prioritize the more specific route, directing traffic for the /25 to the attacker.

• Defense and Bypass: The defense against sub-prefix hijacking is for the legitimate AS to advertise its own max-length prefix (e.g., advertising both the /24 and its constituent /25s). The survey found that only 52% of pool servers were protected by max-length prefixes, leaving nearly half vulnerable to this simpler form of hijacking.

Once the adversary successfully intercepts the connection, the next challenge is to disrupt it stealthily.

Stealthy Disruption Mechanism: Stratum V2 Vulnerability

Initially, an adversary might simply drop all intercepted packets. However, this is highly visible. Long-term BGP hijacks attract attention from network operators, and modern internet connections are sensitive to packet loss (typically less than 1%). The key to stealth lies in a newly discovered vulnerability in Stratum V2.

1. Stratum V2 Protocol Basics: Stratum V2 is designed as the successor to the unencrypted Stratum V1. A key feature is its use of authenticated encryption with associated data (AEAD) to secure communication between the pool and miners. For this, both the sender (pool) and receiver (miner) independently maintain nonce counters. When a message is successfully sent and received, both sides increment their respective counters by one. These counters are crucial for the encryption and decryption process, ensuring message integrity and preventing replay attacks.

1. The Decryption Error Vulnerability: The vulnerability stems from how Stratum V2 handles packets that cannot be decrypted.

• If an adversary intercepts a packet and subtly tampers with it (e.g., flips a few bits), the legitimate receiver (miner) will receive a corrupted packet.
• Upon receiving the corrupted packet, the miner attempts decryption. Since the packet is corrupted, decryption fails.
• Crucially, when decryption fails, the miner's **receiver nonce counter does not increment**. It remains at its previous value.
• However, from the pool's perspective, it successfully sent the packet. Therefore, the pool's **sender nonce counter does increment**.
• This discrepancy leads to nonce counter desynchronization. The pool and the miner now have different expected nonce values for subsequent messages.
• As a result, all subsequent messages sent by the pool to the miner, and vice-versa, will fail decryption because the nonce values will no longer match.

1. Persistent Disruption with Minimal Tampering: This desynchronization means the miner keeps working on an outdated job, unable to receive new work from the pool or successfully submit valid shares. The adversary only needs to tamper with one packet to initiate this persistent disruption. This requires only a brief BGP hijack to intercept and modify that single packet, which can then be released back to its original path. Such short-lived, single-packet tampering events are common due to various network anomalies or misconfigurations and are often ignored by network operators, providing the desired stealth.

1. Misattribution: The observable effect for the miner is that their submitted shares are consistently rejected, or they experience no mining progress. For the pool, it appears as a decrease in the miner's hash rate. As the talk highlights, due to a lack of trust and visibility, these symptoms are typically misattributed: miners might suspect the pool is cheating, while pools might blame miner hardware issues or believe the miner has switched to another pool. This profound difficulty in diagnosing the true root cause allows the attack to persist undetected.

The combination of BGP hijacking for interception and the Stratum V2 nonce desynchronization vulnerability for stealthy, persistent disruption creates a powerful and insidious attack vector that can cripple mining operations on a vast scale without immediate detection.

Demo / Proof of Concept

▶ Watch: Discovering a stealthy attack vulnerability in mining pool protocols (8:30)

While the talk does not present a live, real-time demonstration of the attack in action, it effectively illustrates the proof of concept through quantitative analysis and a clear depiction of the attack's potential scale and impact. The researchers utilized their findings to model the widespread disruption an adversary could achieve against the Bitcoin network, providing compelling evidence of the attack's feasibility and severity.

The demonstration of impact primarily relies on a plot that maps the "ratios of the mining power in Bitcoin that can be disrupted" against "the number of potentially malicious ASes that can perform such an attack." This analytical approach serves as a powerful proof of concept, showcasing the systemic risk posed by these routing vulnerabilities.

Key data points highlighted to demonstrate the attack's capability include:

• Widespread AS Capability: The analysis revealed that "almost all ASes on the internet" possess the technical capability to disrupt a significant portion of Bitcoin's mining power. Specifically, they could disrupt "up to 45% of the Bitcoin mining power" at the time of the research. This underscores that the attack is not limited to a few highly sophisticated nation-state actors but is within reach of a much broader range of adversaries.
• Massive Disruption Potential: The study identified "more than 1,300 different ASes" that could, if they chose to perform a follow-up attack against the Bitcoin consensus (e.g., a double-spending attack), destroy "half of the Bitcoin mining power." This threshold is particularly critical, as controlling 51% of a blockchain's hash rate can enable malicious actors to manipulate transactions and undermine the network's security guarantees.
• Single AS Dominance: The most striking finding presented was the capability of a single, large Autonomous System (used as an example, referred to as "Cloudflare" in the talk) to disrupt an exceptionally high percentage of the Bitcoin mining power. This particular AS was found capable of disrupting "up to 96% of the entire Bitcoin mining power." This highlights the immense centralized power that certain internet infrastructure providers inadvertently hold over decentralized cryptocurrencies and the catastrophic potential if such a powerful AS were compromised or turned malicious.

The presentation of these figures, derived from a comprehensive analysis of BGP routing data and mining pool infrastructure, serves as a robust proof of concept for the routing attacks. It quantifies the real-world risk, moving beyond theoretical possibilities to demonstrate concrete, measurable threats to the operational integrity and security of the Bitcoin network and, by extension, other proof-of-work cryptocurrencies. The methodology involved identifying vulnerable pools, simulating BGP hijacking scenarios, and calculating the aggregated mining power under attack, thereby providing a compelling and data-driven "demonstration" of the attack's efficacy.

Defensive Implications

▶ Watch: Detailed explanation of Stratum v1 protocol vulnerability (10:00)

The detailed analysis of routing attacks on cryptocurrency mining pools, particularly the stealthy disruption enabled by the Stratum V2 vulnerability, necessitates a multi-layered defensive strategy for both protocol developers and mining pool operators. The talk outlines immediate, short-term, and long-term counter-measures to bolster the resilience of this critical infrastructure.

Immediate Mitigation: Patching Stratum V2

The most pressing defensive action is to patch the discovered vulnerability in Stratum V2. The core issue is the nonce counter desynchronization caused by decryption errors. The proposed fix is straightforward:

• Protocol Modification: If a client (miner) cannot decrypt a message, it should immediately reset the connection with the sender (pool). This ensures that both sides re-establish a synchronized state, preventing persistent disruption from a single tampered packet.
• Vulnerability Disclosure and Implementation: The researchers responsibly disclosed this vulnerability to the developers of the Stratum protocol. As a result, the necessary patch has been "implemented and merged into the main code base of Stratum protocol since February this year." This is a crucial step in eliminating the stealthy aspect of the attack. While an adversary can still intercept traffic, they would be forced to drop all packets, making the attack immediately visible and much harder to sustain.

Short-Term Counter-Measures for Mining Pools

Even with the Stratum V2 patch, BGP hijacking remains a threat for direct denial-of-service. Mining pools should implement robust routing security practices:

1. Embrace Decentralization at the AS Level:

• Multiple AS Hosting: Instead of hosting pool servers entirely within a single Autonomous System (AS), pools should distribute their servers across "multiple ASes." This makes it significantly harder for an adversary to hijack all connections, as they would need to compromise or control multiple ASes simultaneously. This strategy inherently increases the cost and complexity for attackers.

1. Enhance Secure Routing Practices:

• RPKI Enforcement: Mining pools should ensure their hosting ASes fully enable and properly configure Resource Public Key Infrastructure (RPKI) for all their advertised prefixes. This helps prevent origin hijacks by ensuring that only authorized ASes can advertise the pool's IP prefixes.
• Max-Length Prefix Advertisements: Pools must ensure their hosting ASes advertise max-length prefixes for their server IP ranges. This directly counters sub-prefix hijacking by making the legitimate route the most specific one, preventing attackers from diverting traffic with a more specific (but unauthorized) advertisement.
• Impact of Short-Term Measures: The research demonstrated that with these short-term counter-measures in place (decentralization across multiple ASes, RPKI, and max-length prefixes), "the number of potential malicious ASes that can perform large-scale disruption decreases significantly." Specifically, "no adversary AS could disrupt more than half of the Bitcoin mining power." This drastically reduces the risk of a single adversary achieving a 51% attack capability.

Long-Term Counter-Measures and Future Work

Beyond immediate and short-term fixes, the talk envisions a more resilient future for critical services like mining pools:

1. Shift to Decentralized Protocols:

• DFMP (Decentralized Federated Mining Pool): The researchers suggest exploring and adopting fully decentralized protocols like the "Decentralized Federated Mining Pool (DFMP)," which were not found to be vulnerable in their surveys. These protocols aim to remove central coordination points, inherently mitigating the impact of attacks targeting single servers or ASes.
• Trade-offs: Acknowledging that decentralized protocols often come with performance trade-offs, the talk emphasizes that "more research needs to be done" to find "a good trade-off between decentralization and performance," which has historically been a challenge in protocol design.

1. Realize Routing Awareness:

• Path Monitoring: Implementing "routing awareness" in the connection between pools and miners would allow them to actively monitor their network paths. This could involve using tools to detect BGP route changes or anomalies.
• Path Diversity and Avoidance: With routing awareness, pools and miners could identify and "avoid certain malicious ASes" or suspicious paths. This might involve dynamically switching to alternative network paths or using multi-homing to connect through different upstream providers, thereby bypassing compromised routes.

By implementing these comprehensive defensive strategies, the cryptocurrency ecosystem can significantly enhance its resilience against routing attacks, protecting miners, pools, and the integrity of the underlying blockchains.

Key Takeaways

• Mining pools are critical but highly vulnerable: Accounting for over 99% of new Bitcoin blocks, mining pools are central to PoW cryptocurrencies but are extensively exposed to routing attacks due to their centralized server architecture and reliance on the public internet.
• Existing routing defenses are insufficient: Despite widespread adoption of RPKI (93% of pools), for-origin hijacking bypasses its protection. Furthermore, nearly half of all pools (48%) remain vulnerable to sub-prefix hijacking due to a lack of max-length prefix advertisements.
• Stratum V2 has a critical stealth vulnerability: A newly discovered flaw in Stratum V2 allows an adversary to persistently disrupt mining connections with minimal effort (tampering with just one packet) by causing nonce counter desynchronization after a decryption error.
• Stealth enables prolonged, undetected attacks: By requiring only single-packet tampering and brief BGP hijacks, the attack becomes difficult to detect, as symptoms are easily misattributed (e.g., miner hardware failure, pool cheating), allowing prolonged disruption.
• Large-scale disruption is feasible: Almost all ASes can disrupt up to 45% of Bitcoin's mining power, with over 1,300 ASes capable of disrupting more than half, and single powerful ASes potentially disrupting up to 96%. This poses a severe threat to blockchain consensus.
• Multi-layered defenses are essential: Immediate patching of Stratum V2, combined with short-term measures like decentralization across multiple ASes and robust secure routing (RPKI, max-length prefixes), significantly reduces attack surface. Long-term solutions include adopting fully decentralized protocols and implementing routing awareness.

About the Speaker(s)

The research was presented by Muoi Tran, Theo von Arx, and Laurent Vanbever.

• Muoi Tran is a Postdoctoral Researcher, contributing significantly to the analysis and presentation of the routing attack methodologies and their impact on cryptocurrency infrastructure.
• Theo von Arx is a PhD Student, actively involved in the deep technical investigation and discovery of the protocol vulnerabilities, particularly within Stratum V2.
• Laurent Vanbever is a Professor, providing guidance and expertise in networking and security, overseeing the comprehensive research into internet routing and its implications for critical digital services.

Their collaborative work demonstrates a strong command of both network routing protocols and cryptocurrency architectures, enabling them to uncover and articulate complex, interconnected vulnerabilities that pose significant risks to the digital economy.