Nov 12, 2026, 12:22 a.m. EST
3 min read
Summary
- A Bitcoin Core flaw let strangers connecting through Tor bypass spam and privacy protections on thousands of nodes by inheriting permissions intended for trusted computers.
- Developers disclosed two other flaws that could prevent affected mining nodes from building valid blocks until restarted or let attackers repeatedly stall block processing.
- All three flaws were patched in October 2025, but detailed advisories were published about 13 months later under a policy designed to give operators time to upgrade.
Strangers linking via Tor could bypass privacy and spam safeguards on thousands of bitcoin nodes because the software mistakenly viewed them as trusted devices.
Bitcoin Core issued an official security warning on Tuesday, approximately 13 months following the launch of a patch. The source code modification had remained visible on GitHub since September 2025, carrying a title stating clearly that whitelist rules ought not to apply to incoming Tor sessions.
This vulnerability constituted one of a trio of issues revealed by developers on Tuesday, all of which were resolved in updates released last October. A separate problem could render a mining node incapable of constructing blocks until manually rebooted by the administrator.
How outside visitors became trusted
A node functions as a computer verifying and passing along bitcoin transactions while maintaining its individual ledger of the blockchain. It generally restricts the volume of data linked machines can transmit, shielding itself against overload attacks.
The whitelist configuration in Bitcoin Core relaxes these constraints for connections deemed reliable by the operator, such as other devices residing on a local network.
The complication arose when software packagers bundled Bitcoin Core alongside Tor, a tool designed for masking internet locations. Incoming Tor traffic appeared to originate locally from the Tor daemon itself. Whenever that daemon address fell inside an approved bracket, external visitors automatically inherited those privileges as well.
This configuration resulted in “thousands of reachable mainnet nodes whitelisting all incoming Tor connections,” according to the bulletin.
Martin Zumsande alongside Antoine Poinsot brought the issue to light in September 2025, prompting Core to classify it with medium severity. Nodes that never activated the whitelist feature remained entirely safe.
The high-severity bug centered on how a node manages competing iterations of the blockchain.
When the broader network abandons a specific chain, transactions originating from those discarded blocks can flow back into the queue of unconfirmed payments, designated as the mempool.
A specific protocol rule established inside Bitcoin Core 28.0 could drop one of these restored transactions while inadvertently retaining dependent child transactions. Consequently, the node would attempt assembling blocks utilizing payments missing their required inputs, triggering internal validation checks to reject them.
Impacted mining infrastructure became unable to formulate valid block templates until rebooted. Niklas Goegge documented the defect on September 26, 2025, and the advisory contains no mention of active exploitation.
The third vulnerability, designated as medium risk, allowed a malicious link to freeze a node’s block processing routines for 10 minutes. An adversary controlling all three designated fast relay connections could sustain the disruption indefinitely. The documentation also points out an alternate setup configuration processing blocks through a separate path that similarly enables endless freezing.
Poinsot privately alerted relevant software distributors regarding the Tor complication on September 19, 2025. Tuesday’s release does not disclose their identities.
Why the advisory came a year later
Core conventionally publishes comprehensive insights concerning medium- and high-risk security flaws two weeks after the final impacted release exits its support lifecycle. This waiting period supplies administrators enough window to apply necessary upgrades before public disclosures emerge.
The final vulnerable software lineage, designated 29.x, hit that milestone on October 27. Tuesday marked exactly two weeks subsequent.
As previously covered by CoinDesk, developers adjusted this disclosure protocol in October for defects that remain straightforward to rediscover, including those uncoverable via basic artificial intelligence prompts. Those particular vulnerabilities now trigger immediate patched deployments accompanied by instant advisories. Tuesday’s disclosures instead adhered to the extended timeline.
Read More: Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy
Originally published at https://www.coindesk.com/tech/2026/11/12/bitcoin-core-reveals-bug-that-made-thousands-of-nodes-trust-any-stranger-on-tor.
