Eclipse attacks isolate blockchain nodes by monopolizing their peer-to-peer connections. The attacks were extensively studied in Bitcoin (SP'15, SP'20, CCS'21, SP'23) and Monero (NDSS'25), but their practicality against Ethereum nodes remains underexplored, particularly in the post-Merge settings. We present the first end-to-end implementation of an eclipse attack targeting Ethereum (2.0 version) execution-layer nodes. Our attack exploits the bootstrapping and peer management logic of Ethereum to fully isolate a node upon restart. We introduce a multi-stage strategy that majorly includes (i) poisoning the node's discovery table via unsolicited messages, (ii) infiltrating Ethereum's DNS-based peerlist by identifying and manipulating the official DNS crawler, and (iii) hijacking idle incoming connection slots across the network to block benign connections. Our DNS list poisoning is the first in the cryptocurrency context and requires only 28 IP addresses over 100 days. Slots hijacking raises outgoing redirection success from 45\% to 95\%. We validate our approach through controlled experiments on Ethereum's Sepolia testnet and broad measurements on the mainnet. Our findings demonstrate that over 80\% of public nodes do not leave sufficient idle capacity for effective slots occupation, highlighting the feasibility and severity of the threat. We further propose concrete countermeasures and responsibly disclosed all findings to Ethereum's security team.

翻译：日食攻击通过垄断区块链节点的点对点连接实现节点隔离。此类攻击已在比特币（SP'15、SP'20、CCS'21、SP'23）和门罗币（NDSS'25）中被广泛研究，但其对以太坊节点的实际威胁仍未被充分探索，尤其在合并升级后的网络环境中。我们首次实现了针对以太坊（2.0版本）执行层节点的端到端日食攻击。该攻击利用以太坊的节点引导与对等节点管理机制，在目标节点重启时实现完全隔离。我们提出多阶段攻击策略，主要包括：（i）通过主动推送消息污染节点发现表，（ii）通过识别并操控官方DNS爬虫渗透以太坊基于DNS的节点列表，（iii）劫持全网空闲入站连接槽以阻断良性连接。我们的DNS列表污染攻击在加密货币领域尚属首次，仅需28个IP地址在100天内即可完成。连接槽劫持将出站重定向成功率从45%提升至95%。我们通过在以太坊Sepolia测试网进行受控实验，并在主网开展大规模测量验证了攻击有效性。研究发现超过80%的公共节点未预留足够的空闲连接容量，这凸显了该威胁的可行性与严重性。我们进一步提出具体防御措施，并将所有发现负责任地披露给以太坊安全团队。