Bitcoin Core reveals bug that made thousands of nodes trust any stranger on Tor

Strangers connecting through Tor could bypass spam and privacy protections on thousands of bitcoin nodes because the software treated them as trusted computers.

Bitcoin Core published a formal security advisory on Tuesday, about 13 months after releasing a fix. The code change had been public on GitHub since September 2025, under a title explicitly saying whitelist permissions should not apply to incoming Tor connections.

The flaw was one of three developers disclosed Tuesday, all patched in releases issued last October. Another could leave a mining node unable to build blocks until its operator restarted it.

How outside visitors became trusted

A node is a computer that checks and relays bitcoin transactions and keeps its own copy of the blockchain. It normally limits how much traffic connected computers can send, protecting itself against attempts to overwhelm it.

Bitcoin Core’s whitelist setting relaxes some of those limits for connections the operator trusts, such as other computers on a local network.

The problem appeared when providers bundled Bitcoin Core with Tor, a service that hides internet addresses. Incoming Tor connections appeared to come from the local Tor software. If that software’s address fell inside a trusted range, outside visitors inherited the permissions too.

The arrangement led to “thousands of reachable mainnet nodes whitelisting all incoming Tor connections,” the advisory said.

Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Core rated it medium severity. Nodes that never enabled the whitelist setting were unaffected.

The high-severity bug involved how a node handles competing versions of the blockchain.

When the network abandons one version, transactions from its discarded blocks can return to the list of pending payments, known as the mempool.

A rule introduced in Bitcoin Core 28.0 could remove one of those restored transactions while leaving behind transactions that depended on it. The node would then try to build blocks containing payments whose inputs were missing, causing its own validity checks to reject them.

An affected mining node could no longer create valid block templates until restarted. Niklas Goegge reported the flaw on Sept. 26, 2025. The advisory does not report any attacks.

The third bug, rated medium, let a malicious connection stall a node’s processing of new blocks for 10 minutes. An attacker controlling all three connections selected for fast block relay could repeat the disruption indefinitely. The advisory also identifies a configuration that only processes blocks as another route to repeated stalling.

Poinsot privately warned affected software providers about the Tor problem on Sept. 19, 2025. Tuesday’s advisory does not name them.

Why the advisory came a year later

Core normally publishes details of medium- and high-severity vulnerabilities two weeks after the last affected release goes out of support. The delay gives operators time to install fixes before a detailed explanation becomes available.

The last affected release series, 29.x, reached that point on Oct. 27. Tuesday was two weeks later.

As CoinDesk earlier reported, developers changed the policy in October for flaws that are easy to rediscover, including through a simple prompt to an AI model. Those now receive a patched release and security advisory as soon as possible. Tuesday’s disclosures followed the longer timetable.