FEATURED PODCAST
October 13, 2025
Validator sniping: How to harvest IP addresses to redirect MEV | Sebastian Bürgel (Gnosis)
This week, the VP of Technology at Gnosis, Sebastian Burgel, joins Jack Sanford to discuss network-layer security gaps, the early days of building on Ethereum, and more.
Sebastian Bürgel's modified Lighthouse client harvests beacon chain attestations to map validator pubkeys to IP addresses, enabling targeted DDoS attacks during known block production slots to redirect MEV rewards.
This consensus-layer attack vector bypasses all smart contract security controls while directly threatening validator economics.
We spoke with Sebastian, VP of Technology at Gnosis and founder of HOPR, about his attestation harvesting methodology using modified beacon nodes that collect signatures and correlate them with originating IP addresses. Most validators broadcast attestations directly from their staking infrastructure, creating this mapping opportunity.
His research demonstrates how home validators without failover infrastructure become prime targets for economically-motivated DDoS attacks that current security frameworks ignore completely.
.png)
.png)
