The Vulnerability of Standard P2P Transaction Broadcasting
In standard peer-to-peer cryptocurrency networks (like traditional Bitcoin or Ethereum), when a node generates a transaction, it immediately broadcasts it to all connected peers in an explosive diffusion/flooding pattern. Adversaries running large networks of listening spy nodes (like Chainalysis or government surveillance clusters) analyze packet arrival times to pinpoint the originating node residential IP address with over 90% accuracy.
The Two-Phase Magic of Dandelion++
To eliminate transaction-to-IP correlation at the network layer, Monero integrated the Dandelion++ routing protocol:
- The Stem Phase (Anonymity Tunnel): When you broadcast an XMR transaction, your node does not flood the network. It passes the transaction to exactly one randomly selected peer along a linear line ("the stem"). Each subsequent peer rolls a cryptographic dice with a 90% probability to forward it to another single peer.
- The Fluff Phase (Explosive Broadcast): With a 10% probability (or when an internal hop timer expires), the holding peer transitions the transaction into the "fluff phase"—broadcasting it to all peers simultaneously across the global gossip mesh.
- Total Origin IP Obfuscation: When spy nodes detect the public fluff broadcast, the transaction originates from a node 5 to 10 hops away from the true creator, breaking network timing analysis completely.
Unbreakable Privacy at the Transport Layer
When combined with Tor or I2P, Dandelion++ ensures that neither ISPs nor global blockchain surveillance firms can link Monero transactions to physical locations. Read our guide on running Monero over I2P garlic routing.
Verify that your Web3 network does not leak residential IP metadata using our free online IP scanner.