The core of many cryptocurrencies is the decentralised validation network operating on proof-of-work technology. In these systems, validation is done by so-called miners who can digitally sign blocks once they solve a computationally-hard problem. Conventional wisdom generally considers this protocol as secure and stable as miners are incentivised to follow the behaviour of the majority. However, whether some strategic mining behaviours occur in practice is still a major concern. In this paper we target this question by focusing on a security threat: a selfish mining attack in which malicious miners deviate from protocol by not immediately revealing their newly mined blocks. We propose a statistical test to analyse each miner's behaviour in five popular cryptocurrencies: Bitcoin, Litecoin, Monacoin, Ethereum and Bitcoin Cash. Our method is based on the realisation that selfish mining behaviour will cause identifiable anomalies in the statistics of miner's successive blocks discovery. Secondly, we apply heuristics-based address clustering to improve the detectability of this kind of behaviour. We find a marked presence of abnormal miners in Monacoin and Bitcoin Cash, and, to a lesser extent, in Ethereum. Finally, we extend our method to detect coordinated selfish mining attacks, finding mining cartels in Monacoin where miners might secretly share information about newly mined blocks in advance. Our analysis contributes to the research on security in cryptocurrency systems by providing the first empirical evidence that the aforementioned strategic mining behaviours do take place in practice.

翻译：许多加密货币的核心是基于工作量证明技术运行的去中心化验证网络。在这些系统中，验证工作由所谓的矿工完成，一旦他们解决了一个计算难题，就可以对区块进行数字签名。传统观点普遍认为该协议是安全稳定的，因为矿工受到激励去遵循多数人的行为。然而，某些策略性挖矿行为是否在实践中确实存在，仍是一个重大关切。本文聚焦于这一问题，针对一种安全威胁：自私挖矿攻击，即恶意矿工偏离协议，不立即公开其新挖出的区块。我们提出了一种统计检验方法，用于分析五种流行加密货币中每个矿工的行为：比特币、莱特币、莫纳币、以太坊和比特币现金。我们的方法基于如下认识：自私挖矿行为将在矿工连续发现区块的统计特征中引发可识别的异常。其次，我们应用基于启发式的地址聚类来提高此类行为的可检测性。我们发现莫纳币和比特币现金中存在显著的非正常矿工，在以太坊中程度较轻。最后，我们将方法扩展用于检测协同自私挖矿攻击，并在莫纳币中发现了矿工卡特尔——矿工可能私下提前共享新挖区块的信息。我们的分析为加密货币系统的安全性研究提供了首个经验证据，证明前述策略性挖矿行为确实在现实中发生。