Deanonymizing Transactions Originating from Monero Tor Hidden Service Nodes

Monero is a privacy-focused cryptocurrency that incorporates anonymity networks (such as Tor and I2P) and deploys the Dandelion++ protocol to prevent malicious attackers from linking transactions with their source IPs. However, this paper highlights a vulnerability in Monero's integration of the Tor network, which allows an attacker to successfully deanonymize transactions originating from Monero Tor hidden service nodes at the network-layer level. Our approach involves injecting malicious Monero Tor hidden service nodes into the Monero P2P network to correlate the onion addresses of incoming Monero Tor hidden service peers with their originating transactions. And by sending a signal watermark embedded with the onion address to the Tor circuit, we establish a correlation between the onion address and IP address of a Monero Tor hidden service node. Ultimately, we correlate transactions and IPs of Monero Tor hidden service nodes. Through experimentation on the Monero testnet, we provide empirical evidence of the effectiveness of our approach in successfully deanonymizing transactions originating from Monero Tor hidden service nodes.