Bitcoin Core reveals bug that made thousands of nodes trust any stranger on Tor

Bitcoin Core reveals bug that made thousands of nodes trust any stranger on Tor

The flaw was fixed in October 2025 and kept quiet until Tuesday. It came out alongside a high-severity bug that could stop a miner from producing blocks until someone restarted it.

Developers disclosed two other flaws that could prevent affected mining nodes from building valid blocks until restarted or let attackers repeatedly stall block processing.

All three flaws were patched in October 2025, but detailed advisories were published about 13 months later under a policy designed to give operators time to upgrade.

Bitcoin Core published a formal security advisory on Tuesday, about 13 months after releasing a fix. The code change had been public on GitHub since September 2025, under a title explicitly saying whitelist permissions should not apply to incoming Tor connections.

The flaw was one of three developers disclosed Tuesday, all patched in releases issued last October. Another could leave a mining node unable to build blocks until its operator restarted it.

**How outside visitors became trusted**

A node is a computer that checks and relays bitcoin transactions and keeps its own copy of the blockchain. It normally limits how much traffic connected computers can send, protecting itself against attempts to overwhelm it.

Bitcoin Core’s whitelist setting relaxes some of those limits for connections the operator trusts, such as other computers on a local network.

The problem appeared when providers bundled Bitcoin Core with Tor, a service that hides internet addresses. Incoming Tor connections appeared to come from the local Tor software. If that software’s address fell inside a trusted range, outside visitors inherited the permissions too.

Grayscale opens in-kind crypto ETF investing to more investors

0 seconds of 11 minutes, 12 seconds Volume 0%

Press shift question mark to access a list of keyboard shortcuts

Keyboard Shortcuts Enabled Disabled

Shortcuts Open/Close/ or ?

Fullscreen/Exit Fullscreen f

Decrease Caption Size-

Increase Caption Size+ or =

CZ on Binance's $6.3B hack

0.5x 1x 1.25x 1.5x 2x

Auto 180p 1080p 720p 406p 270p 180p

The arrangement led to “thousands of reachable mainnet nodes whitelisting all incoming Tor connections,” the advisory said.

Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Core rated it medium severity. Nodes that never enabled the whitelist setting were unaffected.

The high-severity bug involved how a node handles competing versions of the blockchain.

When the network abandons one version, transactions from its discarded blocks can return to the list of pending payments, known as the mempool.

A rule introduced in Bitcoin Core 28.0 could remove one of those restored transactions while leaving behind transactions that depended on it. The node would then try to build blocks containing payments whose inputs were missing, causing its own validity checks to reject them.

An affected mining node could no longer create valid block templates until restarted. Niklas Goegge reported the flaw on Sept. 26, 2025. The advisory does not report any attacks.

The third bug, rated medium, let a malicious connection stall a node’s processing of new blocks for 10 minutes. An attacker controlling all three connections selected for fast block relay could repeat the disruption indefinitely. The advisory also identifies a configuration that only processes blocks as another route to repeated stalling.

Poinsot privately warned affected software providers about the Tor problem on Sept. 19, 2025. Tuesday’s advisory does not name them.

**Why the advisory came a year later**

Core normally publishes details of medium- and high-severity vulnerabilities two weeks after the last affected release goes out of support. The delay gives operators time to install fixes before a detailed explanation becomes available.

The last affected release series, 29.x, reached that point on Oct. 27. Tuesday was two weeks later.

As CoinDesk earlier reported, developers changed the policy in October for flaws that are easy to rediscover, including through a simple prompt to an AI model. Those now receive a patched release and security advisory as soon as possible. Tuesday’s disclosures followed the longer timetable.

1. 1DTCC adds Solana to Wall Street tokenization plans, targeting 2027 rollout16 minutes ago

2. 2Crypto for Advisors: The blockchain built to run financial markets28 minutes ago

3. 3Jupiter adds Anchorage-backed USDGO to its $1 billion Solana lending platform1 hour ago

4. 4The next Congress will write rules for AI and emerging tech. They should use the stuff first.1 hour ago

5. 5Nvidia CEO Huang quits company he co-founded, led for 3 decades. Shares slump2 hours ago

6. 6Bitcoin weakness erases September's bullish signal3 hours ago

7. 7UK bank Griffin raises $20 million to expand into stablecoin payments3 hours ago

9. 9Bitcoin dips with Nvidia as ETF outflows reach day five4 hours ago

10. 10Polymarket trims workforce under investor pressure as Kalshi surges ahead5 hours ago

Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.

Commissioned byRealFi

Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.

Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.

© 2026 CoinDesk, Inc.

Disclosure & Polices: CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. CoinDesk has adopted a set of principles aimed at ensuring the integrity, editorial independence and freedom from bias of its publications. CoinDesk is part of Bullish (NYSE:BLSH), an institutionally focused global digital asset platform that provides market infrastructure and information services. Bullish owns and invests in digital asset businesses and digital assets and CoinDesk employees, including journalists, may receive Bullish equity-based compensation.

Consent Leg.Interest

[x] checkbox label label

[x] checkbox label label

[x] checkbox label label

- [x] checkbox label label

Reject All Allow All