Recently there were several research papers that have been released about Monero. The first, Monerovis, is a visualization tool about Monero, which has a website that looks very clean and allows you to browse transactions and mark poisoned outputs. The other two separate research papers, both about attacking Monero's network topology, were uploaded on 9/10/2026. This happened to be a coincidence, as the papers were from two different teams. The MRL is already on top of it and looking through the findings, with results so far being underwhelming relative to what the claims were. Tomorrow during the MRL it looks like they will be discussing Monerovis and the Eclipse attack.
- Monerovis
https://dnvie.com/docs/MoneroVis.pdf
https://monerovis.com/#/
As mentioned above, this looks like a slick new block explorer which allows you to mark poisoned outputs and investigate ring signatures. It doesn't look like any new information, but it is FOSS and fun to play around with.
- "Are Monero Nodes Truly Safe? Fully Eclipsing Monero's P2P network!"
This paper is by the same team that released the Tor paper over the summer which claimed to attack Monero. That paper, which did have interesting insights, would ultimately be too costly to run and therefore didn't really get much traction. Now they are back with a new paper which claims to create an eclipse attack which targets unreachable nodes.
Claude review: https://paste.debian.net/hidden/dde67217
MRL reactions: Rucknium is skeptical initially because he couldn't get some of the code to run and, after asking the researchers for help, he was ignored.
Selsta says that the findings were posted on HackerOne in advance, but when asked to test a patch in the simulation, they never follwed up.
This will be discussed tomorrow by the MRL team. Looks like they are running tests now on it.
- "An Analysis of Monero's Network Topology"
Abstract: Monero is one of the most valuable, secure and popular cryptocurrencies in the world. Little is known about the Monero network, e.g. its topology or the behavior of the nodes forming the network, despite its interest to a variety of parties such as financial institutions, legitimate financially or technologically savvy individuals, criminals and law enforcement. In order to address this problem I identify reachable active nodes on the network. I subsequently analyze the network for key largescale and node-level features to characterize network topology and behavior. Using the Monero protocol itself, I use messaging and peer-seeding procedures to build an observed peer edge list of the network. We then use public data and graph analysis to characterize the concentration of the network. We identify 20,560 active nodes on the network forming 10,626,886 edges in 2,116 autonomous systems across 141 countries. We show the network has a large overall distribution and low modularity but is concentrated in a small proportion of BGP prefixes, potentially boosting the effects of routing attacks. We also uncover upwards of 24% of nodes misusing Monero's peering procedure to participate in 67% of all network edges. Despite little attention so far, network features and behavior have strong implications for all Monero users, which they should consider to improve their benefit from using the Monero network.
MRL Reaction:
Rucknium: Says the interesting part of this paper is that he did not think it was possible to figure out which nodes are connected with eachother, however he later refers to this as misleading. He further states that this does not mention a relevant recent paper which already did important research.