NODE CENSUS
How many of Bitcoin's reachable nodes are distinct machines? A listening node costs almost nothing, so any raw count is an upper bound on reality — this page never publishes a single number. For whichever population you select, it publishes a bounds ladder (each rung labeled with its method and bias), arrival-cohort and provisioning-wave detection, network-mix and hosting forensics, geography, monoculture metrics, and a first-party view from our own node. Node counts are sentiment telemetry, not consensus weight — consensus is proof-of-work.
Current lens: BIP-110 signaling, while it lasts — those rules expire ~Sept 2027 and that population empties. Every other measurement here outlives it, and the same forensics apply to the next contested upgrade, the next hosting cluster, the next Sybil claim.
loading…
Population
Unique nodes — bounds ladder
Method
Monotone ladder: raw crawler count ≥ conservative public dedup (collapse same-/24
clearnet nodes only when user-agent + services + protocol are identical; Tor/I2P left
uncollapsed) ≥ aggressive dedup (one identity per /16; Tor/I2P collapsed to
fingerprint cohorts). The true count lies somewhere inside — each edge fails in a
known direction.
External estimate
wk057's tx-propagation-fingerprint dedup is plotted as a dashed annotation, never
chained into the ladder: its methodology is private and unverifiable.
btcnodes.io snapshot
loading…
Where the locatable nodes are
Source
btcnodes.io
summary.map_points — a 2,500-node geolocated sample
(city, country, ASN, organization per node).
Read the emptiness
Only clearnet nodes have coordinates at all. Every Tor/I2P node — the
majority of the network, and ~80% of Knots — appears nowhere on this map.
Dense single-city stacks in hosting ASNs are the visual signature of concentration
(which is evidence of shared operators, not proof of fakery).
Hosting concentration — top ASNs
Method
Autonomous systems hosting the geolocated sample, with the Knots and
signaling share inside each. A handful of ASNs carrying a large share of a
population means a handful of account holders could operate them —
the cheapest way to manufacture apparent consensus.
of the 2,500-node geo sample
loading…
Countries — full reachable set
Source
btcnodes.io country rollup over all locatable reachable nodes (not the map
sample). Tor/I2P nodes are excluded by nature — percentages are of the
locatable subset only.
loading…
Daily first-seen arrivals — Knots vs Core (observed)
Method
A node's first appearance day, recorded from our own census cycles (every 15 min).
A provisioning wave — hundreds of same-fingerprint nodes arriving in one
day, concentrated in one /16 — is the signature to watch, especially around the
fork. Flag: arrivals > 30-day median + 4·MAD (robust statistics) and ≥ 20;
corroborated when one /16 holds ≥ 25% of the day's arrivals.
Why it starts today, not months ago
btcnodes keeps 91 days of snapshots but its index rejects every pagination
parameter (HTTP 503), so historical snapshots cannot be enumerated — a
retroactive backfill is impossible. This timeline therefore begins the day we
started observing and grows daily. The first day is a baseline (the whole
pre-existing network) and is excluded from arrivals.
Where the nodes live — network mix
Why it matters
Tor/I2P identities cost ~nothing (hundreds per $5 VPS, no IP or ASN to dedup) while
clearnet Sybils cost real routable IPs. A population living mostly on privacy
networks is structurally unverifiable — not proven fake, but unprovable
real. Lopp's heuristic: compare the Tor-share of Knots vs everyone else.
loading…
Clusters — subnets & ASNs
Sources
/24 clusters among signaling clearnet nodes computed here from the snapshot;
subnet/ASN statistical outliers from
willcl_ark's dnsseedrs Sybil dashboard (live JSON, published thresholds).
Caveat
Clusters are evidence, not verdicts: the Start9 episode showed ~1,000
"duplicates" that were genuine storefront customers sharing an ISP footprint.
loading…
Our own node's view
Method
Live
getpeerinfo from this site's own Bitcoin node: what implementations
and service bits our actual peers advertise. First-party and unfakeable-by-crawlers,
but a self-selected sample (outbound peer selection is not uniform).
Aggregates only — no peer addresses are published.
loading…
Population diversity
Method
Shannon entropy / perplexity (effective distinct count) / top-1 share over user-agent
strings and services bitmasks. A Sybil fleet is a monoculture; an organic population is
ragged. Weak evidence alone — a fresh security release also collapses diversity —
corroborating only.
loading…
Read this before quoting any number above. These caveats are permanent — they apply to
every node-count claim, not just today's.
(1) Dedup can false-positive: in Sept 2025, subnet clustering flagged 1,758 Knots nodes as Sybils;
Start9 showed
up to ~1,000 were genuine customers of their node-in-a-box sharing an ISP footprint, and the claim was retracted.
(2) The other direction is real too:
wk057's paid tx-fingerprint dedup
finds 71% of signaling entries duplicated, and
Lopp documents
why reachable nodes are nearly free to fake. (3) Crawlers disagree on the denominator itself
(Coin Dance ~23k, btcnodes ~28k, bip110.xyz ~32k, wk057 ~132k incl. unreachable). (4) None of this is
consensus weight: node counts express sentiment; consensus is proof-of-work. For the current
BIP-110 activation attempt, the binding metric is miner signaling — see the
Fork Monitor.
And the point of measuring at all: this page exists to show the data and its uncertainty, not to influence the outcome. It takes no side on BIP-110, on any implementation, or on whose nodes are legitimate. Dedup bounds are published as a bracket with each edge's failure mode named, external estimates are labeled unverifiable, and the evidence that contradicts a tidy conclusion — the Start9 false positives, the currently Core-dominated clusters — is shown rather than filtered out. Read it as a measurement with error bars, never as a verdict on anyone.
And the point of measuring at all: this page exists to show the data and its uncertainty, not to influence the outcome. It takes no side on BIP-110, on any implementation, or on whose nodes are legitimate. Dedup bounds are published as a bracket with each edge's failure mode named, external estimates are labeled unverifiable, and the evidence that contradicts a tidy conclusion — the Start9 false positives, the currently Core-dominated clusters — is shown rather than filtered out. Read it as a measurement with error bars, never as a verdict on anyone.