Bitcoin Core reveals bug that made thousands of nodes trust any stranger on Tor

Tech Bitcoin Core reveals bug that made thousands of nodes trust any stranger on Tor The flaw was fixed in October 2025 and kept quiet until Tuesday. It came out alongside a high-severity bug that could stop a miner from producing blocks until someone restarted it. By Shaurya Malwa Nov 12, 2026, 12:22 a.m. EST 3 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on Enlarge image Summary Show A Bitcoin Core flaw let strangers connecting through Tor bypass spam and privacy protections on thousands of nodes by inheriting permissions intended for trusted computers. Developers disclosed two other flaws that could prevent affected mining nodes from building valid blocks until restarted or let attackers repeatedly stall block processing. All three flaws were patched in October 2025, but detailed advisories were published about 13 months later under a policy designed to give operators time to upgrade. Strangers connecting through Tor could bypass spam and privacy protections on thousands of bitcoin nodes because the software treated them as trusted computers. Bitcoin Core published a formal security advisory on Tuesday, about 13 months after releasing a fix. The code change had been public on GitHub since September 2025, under a title explicitly saying whitelist permissions should not apply to incoming Tor connections. The flaw was one of three developers disclosed Tuesday, all patched in releases issued last October. Another could leave a mining node unable to build blocks until its operator restarted it. How outside visitors became trusted A node is a computer that checks and relays bitcoin transactions and keeps its own copy of the blockchain. It normally limits how much traffic connected computers can send, protecting itself against attempts to overwhelm it. Bitcoin Core’s whitelist setting relaxes some of those limits for connections the operator trusts, such as other computers on a local network. The problem appeared when providers bundled Bitcoin Core with Tor, a service that hides internet addresses. Incoming Tor connections appeared to come from the local Tor software. If that software’s address fell inside a trusted range, outside visitors inherited the permissions too. The arrangement led to “thousands of reachable mainnet nodes whitelisting all incoming Tor connections,” the advisory said. Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Core rated it medium severity. Nodes that never enabled the whitelist setting were unaffected. The high-severity bug involved how a node handles competing versions of the blockchain. When the network abandons one version, transactions from its discarded blocks can return to the list of pending payments, known as the mempool. A rule introduced in Bitcoin Core 28.0 could remove one of those restored transactions while leaving behind transactions that depended on it. The node would then try to build blocks containing payments whose inputs were missing, causing its own validity checks to reject them. An affected mining node could no longer create valid block templates until restarted. Niklas Goegge reported the flaw on Sept. 26, 2025. The advisory does not report any attacks. The third bug , rated medium, let a malicious connection stall a node’s processing of new blocks for 10 minutes. An attacker controlling all three connections selected for fast block relay could repeat the disruption indefinitely. The advisory also identifies a configuration that only processes blocks as another route to repeated stalling. Poinsot privately warned affected software providers about the Tor problem on Sept. 19, 2025. Tuesday’s advisory does not name them. Why the advisory came a year later Core normally publishes details of medium- and high-severity vulnerabilities two weeks after the last affected release goes out of support. The delay gives operators time to install fixes before a detailed explanation becomes available. The last affected release series, 29.x, reached that point on Oct. 27. Tuesday was two weeks later. As CoinDesk earlier reported, developers changed the policy in October for flaws that are easy to rediscover, including through a simple prompt to an AI model. Those now receive a patched release and security advisory as soon as possible. Tuesday’s disclosures followed the longer timetable. Read More: Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy Latest Crypto News 1 Zcash holders to vote on pulling 50,000 ZEC, worth $50 million, from grants treasury 1 hour ago 2 Ripple’s bank-lending system moves closer to launch on the XRP Ledger 1 hour ago 3 Nvidia perps crash 7% as CEO Jensen Huang reportedly faces the axe 2 hours ago 4 Crypto Long & Short: The GENIUS Act’s guarantees don’t cover DeFi lending 15 hours ago 5 OKXICE to debut tokenized stock trading with Strategy, Coinbase, Circle this month 18 hours ago 6 Meet Spiko, the largest tokenized fund in the world you’ve probably never heard about 18 hours ago 7 Live news: Bitcoin remains under pressure as CoreWeave, Nvidia lead AI rebound 18 hours ago 8 Bitcoin barely flinches at hot CPI as ETF selling slows 18 hours ago 9 Bitcoin sits out stock rebound as ETF outflows extend to fourth day 19 hours ago 10 Kraken's xStocks adds 200 UK and EU shares as its assets top $1.1 billion 20 hours ago Latest Research Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. By CoinDesk Research Sep 24, 2026 Commissioned by RealFi Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. Why it matters : Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. View Full Report More From Tech Zcash holders to vote on pulling 50,000 ZEC, worth $50 million, from grants treasury Ripple’s bank-lending system moves closer to launch on the XRP Ledger Live news: Bitcoin remains under pressure as CoreWeave, Nvidia lead AI rebound