Warning: Spam attack from 2016 has resumed

Since about 09:00 UTC, 40 MB of transactions have been added to the mempool. Vegard from the LND slack pointed out this transaction, which certainly looks like spam, but perhaps it's legitimate. After all, it did pay a 332 sat/B(!) fee, which is quite high right now.

However, if you investigate, you'll notice some other oddities. Look at the transaction the input references. Of those outputs that are spent, most are included with outputs from numerous other addresses, all containing 0.0001 BTC. They all spend to the same address, 1P3rU1Nk1pmc2BiWC8dEy9bZa1ZbMp5jfg and all have an OP_RETURN output. Again, it looks strange but I'm not certain the precise purpose of the OP_RETURN.

What leads me to believe that this is (one of?) the same spammer(s?) from 2016? Look at the history of the primary address 1HmixPDLTcVSqiyne2JFLj1F1hKVmpC1pU. This exact same behavior dates back to November 2016. It appears they've been consolidating their outputs (the fan-in part of the 2-stage attack explained by LaurentMT). Now they've begun another round of the fan-out attack.

Beware the "mempool is full" FUD that will be arriving, and ensure that you're using a wallet that sanely calculates fees. You can use tools like Johoe's mempool visualizer to manually determine the fee you'll need to probably get in the next block or two by looking at the number of bytes above a specific fee level.

Submitted April 14, 2018 at 09:03PM by chrisrico https://ift.tt/2qwI2sd