Technology

The decentralized, encrypted communications network I2P experienced significant disruptions over the past week as the massive Kimwolf botnet attempted to leverage the platform. Security researchers have identified this as a large-scale Sybil attack, where a single entity floods a peer-to-peer network with fake identities to overwhelm legitimate users. The incident highlights the ongoing challenges faced by anonymity networks in defending against malicious actors seeking to exploit their infrastructure.

Kimwolf, an “Internet of Things” (IoT) botnet that surfaced in late 2025, has rapidly infected millions of devices – including TV streaming boxes, digital picture frames, and routers – turning them into relays for malicious traffic and large-scale distributed denial-of-service (DDoS) attacks. I2P, designed to anonymize and secure online communications by routing data through multiple encrypted layers across volunteer-operated nodes, became a target as the botnet’s operators sought alternative command and control (C2) channels.

The disruptions began on February 3rd, with I2P users reporting tens of thousands of new routers suddenly overwhelming the network, preventing connections. One user reported their router freezing when the number of connections exceeded 60,000. The influx of traffic was far beyond the network’s normal capacity. According to Lance James, founder of cybersecurity consultancy Unit 221B and the original founder of I2P, the network typically consists of between 15,000 and 20,000 devices, a figure significantly lower than the approximately 700,000 bots Kimwolf attempted to onboard.

Remarkably, the Kimwolf operators openly acknowledged in their Discord channel that the I2P disruption was accidental, occurring while they were attempting to integrate the 700,000 infected devices as network nodes. This admission provides insight into the botnet’s operators’ efforts to build a resilient C2 infrastructure, less susceptible to takedown attempts by security companies and network operators.

Sybil Attack and the Search for Resilience

The tactic employed by Kimwolf – flooding I2P with a massive number of controlled nodes – is known as a Sybil attack. This type of attack is particularly effective against peer-to-peer networks like I2P, where trust and reputation are crucial for maintaining network integrity. By controlling a disproportionate number of nodes, an attacker can disrupt legitimate traffic and potentially compromise the anonymity of the network. Benjamin Brundage, founder of Synthient, a startup tracking proxy services, noted that the Kimwolf operators are actively seeking command and control methods that are resistant to disruption. Brundage was the first to document Kimwolf’s unique spreading techniques.

While I2P was the initial target, the Kimwolf operators have also been experimenting with Tor, another prominent anonymity network, as a potential backup C2 channel. However, there have been no recent reports of widespread disruptions to the Tor network. “I don’t think their goal is to take I2P down,” Brundage said. “It’s more they’re looking for an alternative to keep the botnet stable in the face of takedown attempts.”

This isn’t the first time Kimwolf has caused headaches for internet infrastructure providers. Late last year, the botnet instructed millions of infected devices to apply Cloudflare’s domain name system (DNS) settings, causing control domains associated with Kimwolf to temporarily outrank major websites like Amazon, Apple, Google, and Microsoft in Cloudflare’s public rankings.

Current Status and Future Outlook

As of February 16, 2026, the I2P network is operating at roughly half of its normal capacity, according to James. A new release is currently being rolled out, aimed at improving network stability for users. Interestingly, Brundage reports that recent internal conflicts within the Kimwolf operation, leading to the departure of experienced developers, may have contributed to a “rookie mistake” that resulted in a 600,000-device reduction in the botnet’s size. “It seems like they’re just testing stuff, like running experiments in production,” Brundage observed. “But the botnet’s numbers are dropping significantly now, and they don’t seem to realize what they’re doing.”

The Kimwolf botnet’s attempt to exploit I2P underscores the constant arms race between threat actors and the defenders of anonymity networks. While the immediate disruption to I2P appears to be subsiding, the incident serves as a stark reminder of the vulnerabilities inherent in decentralized systems and the need for ongoing vigilance and innovation in cybersecurity. The situation remains fluid, and continued monitoring of both Kimwolf and I2P is crucial.

What are your thoughts on the future of anonymity networks in the face of increasingly sophisticated botnet attacks? Share your insights in the comments below.

The world of cryptocurrency, often touted for its transparency, is facing increased scrutiny as international tax enforcement agencies uncover links between over-the-counter (OTC) trading desks, cryptocurrency payment processors, and illicit financial activity. The Joint Chiefs of Global Tax Enforcement (J5) recently published two advisories detailing how these platforms are being exploited to obfuscate and move funds tied to criminal enterprises, raising concerns among global financial regulators.

The advisories highlight a significant shift in how illicit funds are being handled. While traditional financial institutions are subject to stringent regulations, OTC crypto desks and payment processors offer a degree of anonymity that can be attractive to those seeking to evade taxes or launder money. This isn’t a marginal issue. the J5 estimates that daily trading activity on OTC desks reached $1.44 billion in 2026, dwarfing the $74.51 million seen at traditional cryptocurrency exchanges, according to their findings. J5 Cyber Challenge data formed the basis for these advisories.

OTC Desks: A Haven for Anonymity

OTC trading desks operate as platforms enabling individuals to buy and sell digital assets outside of public exchanges. This off-exchange trading provides clients with both anonymity and reliability when moving large sums of money or cryptocurrency. As the Australian Taxation Office (ATO) noted in a statement regarding the J5’s findings, this characteristic makes these desks potentially valuable tools for tax evaders and money launderers. Accounting Times reported on the J5’s concerns.

The scale of suspicious activity linked to these platforms is substantial. Nearly $236 billion in suspicious activity has been reported to the Financial Crimes Enforcement Network (FinCEN) in connection with OTC trading platforms, according to the J5. This figure underscores the growing concern that these platforms are being used to facilitate illegal financial flows.

Cryptocurrency Payment Processors Under the Microscope

The J5’s investigation too focused on cryptocurrency payment processors, which allow for direct payment for goods and services using digital assets. While offering convenience and speed, these processors are also vulnerable to misuse. The J5 reports a more than 1000% increase in suspicious activity reports tied to these processors between 2020 and 2024. To date, financial institutions and digital asset providers have reported $5 billion in suspicious activity to FinCEN associated with these processors. Decrypt detailed the findings.

The J5’s Cyber Challenge, launched in September 2024, specifically targeted data related to OTC cryptocurrency trading desks and cryptocurrency payment platforms, providing the foundation for these latest advisories. The taskforce is now recommending that financial intelligence units utilize specific keyword searches when reviewing suspicious activity reports to identify patterns indicative of money laundering or tax evasion on these platforms.

The J5 is not simply identifying the problem; it’s actively working to equip law enforcement with the tools to combat it. The organization plans to continue analyzing the data gathered to further its efforts against international and transactional tax crime and money laundering.

As the cryptocurrency landscape continues to evolve, the J5’s work serves as a critical reminder of the need for vigilance and robust regulatory oversight to prevent these technologies from being exploited for illicit purposes. The increasing sophistication of criminal actors necessitates a proactive and collaborative approach to safeguarding the integrity of the financial system.

What remains to be seen is how quickly regulators can adapt to these evolving tactics and implement effective measures to mitigate the risks posed by OTC crypto desks and payment processors. The J5’s ongoing investigation and the dissemination of these advisories represent an critical step in that direction.

Have your say: What further steps should be taken to regulate the cryptocurrency space and prevent illicit financial activity?