[Paper Review] Twisted by the Pools: Detection of Selfish Anomalies in Proof-of-Work Mining

Shengnan Li, Carlo Campajola+1 more|arXiv (Cornell University)|Aug 11, 2022

Blockchain Technology Applications and Security4 citations

TL;DR

This paper proposes a statistical method to detect selfish mining attacks in proof-of-work cryptocurrencies by analyzing anomalies in miners' block discovery intervals, combined with heuristics-based address clustering to identify coordinated behavior. It provides the first empirical evidence of selfish mining in Monacoin, Bitcoin Cash, and Ethereum, revealing mining cartels in Monacoin that coordinate block withholding through pre-sharing of mined blocks.

ABSTRACT

The core of many cryptocurrencies is the decentralised validation network operating on proof-of-work technology. In these systems, validation is done by so-called miners who can digitally sign blocks once they solve a computationally-hard problem. Conventional wisdom generally considers this protocol as secure and stable as miners are incentivised to follow the behaviour of the majority. However, whether some strategic mining behaviours occur in practice is still a major concern. In this paper we target this question by focusing on a security threat: a selfish mining attack in which malicious miners deviate from protocol by not immediately revealing their newly mined blocks. We propose a statistical test to analyse each miner's behaviour in five popular cryptocurrencies: Bitcoin, Litecoin, Monacoin, Ethereum and Bitcoin Cash. Our method is based on the realisation that selfish mining behaviour will cause identifiable anomalies in the statistics of miner's successive blocks discovery. Secondly, we apply heuristics-based address clustering to improve the detectability of this kind of behaviour. We find a marked presence of abnormal miners in Monacoin and Bitcoin Cash, and, to a lesser extent, in Ethereum. Finally, we extend our method to detect coordinated selfish mining attacks, finding mining cartels in Monacoin where miners might secretly share information about newly mined blocks in advance. Our analysis contributes to the research on security in cryptocurrency systems by providing the first empirical evidence that the aforementioned strategic mining behaviours do take place in practice.

Motivation & Objective

• To investigate whether selfish mining—where miners withhold blocks to gain strategic advantage—occurs in real-world proof-of-work cryptocurrencies.
• To develop a statistical test that identifies abnormal block discovery patterns indicative of selfish mining behavior.
• To improve detection accuracy by applying heuristics-based address clustering to link transactions and identify potential mining pools or coordinated actors.
• To detect not only individual selfish miners but also coordinated attacks involving collusion among miners.
• To provide empirical evidence of strategic mining behaviors in live blockchain networks, challenging the assumption of protocol stability under honest participation.

Proposed method

• The method uses inter-block time intervals to detect statistical anomalies in miners' block discovery patterns, as selfish mining causes non-Poisson, clustered block times.
• A statistical hypothesis test is applied to each miner’s block discovery sequence to identify deviations from the expected exponential distribution under honest mining.
• Address clustering heuristics (H₁, H₂, Hₚ) are used to group multiple addresses under a single entity, enabling identification of pooled or coordinated mining behavior.
• The approach is applied across five PoW blockchains: Bitcoin, Litecoin, Monacoin, Ethereum, and Bitcoin Cash, with time windows adjusted per block time to ensure consistent sampling.
• The method is extended to detect coordinated selfish mining by identifying clusters of miners with synchronized block withholding patterns and shared address clusters.
• Empirical analysis is conducted on full-chain data from each cryptocurrency’s launch to end-2020, using labeled pool names or miner addresses.

Experimental results

Research questions

• RQ1 Do selfish mining behaviors—where miners withhold blocks to gain strategic advantage—occur in practice in major proof-of-work cryptocurrencies?
• RQ2 Can statistical anomalies in block discovery intervals reliably detect selfish mining without relying on external trust or labeled data?
• RQ3 To what extent can address clustering heuristics improve the detection of coordinated mining behavior?
• RQ4 Are there detectable mining cartels that coordinate block withholding in real-world blockchain networks?
• RQ5 How prevalent are selfish mining attacks across different cryptocurrencies, particularly those with shorter block times or unstable difficulty adjustments?

Key findings

• The study provides the first empirical evidence of selfish mining attacks in real-world PoW blockchains, with detectable anomalies in Monacoin, Bitcoin Cash, and Ethereum.
• Monacoin exhibits a marked presence of abnormal miners, with evidence of coordinated selfish mining attacks involving multiple miners sharing information about newly mined blocks in advance.
• In Bitcoin Cash, selfish mining behavior is detected with significant statistical confidence, consistent with prior reports of instability due to the Emergency Difficulty Adjustment (EDA) algorithm.
• Ethereum shows detectable selfish mining patterns, though less pronounced than in Monacoin and Bitcoin Cash, likely due to its short block time and high network activity.
• Address clustering techniques successfully identify groups of miners acting in coordination, particularly in Monacoin, where mining cartels appear to operate through pre-shared block information.
• The statistical test successfully isolates abnormal miners in all five analyzed blockchains, with the highest detection rates in Monacoin and Bitcoin Cash, where mining pool dynamics and protocol instability amplify strategic behaviors.