Bitcoin Core reveals bug that made thousands of nodes trust any stranger on Tor
Strangers connecting through Tor could bypass spam and privacy protections on thousands of bitcoin nodes because the software treated them as trusted computers.
Bitcoin Core published a formal security advisory on Tuesday, about 13 months after releasing a fix. The code change had been public on GitHub since September 2025, under a title explicitly saying whitelist permissions should not apply to incoming Tor connections.
The flaw was one of three developers disclosed Tuesday, all patched in releases issued last October. Another could leave a mining node unable to build blocks until its operator restarted it.
How outside visitors became trusted
A node is a computer that checks and relays bitcoin transactions and keeps its own copy of the blockchain. It normally limits how much traffic connected computers can send, protecting itself against attempts to overwhelm it.
Bitcoin Core’s whitelist setting relaxes some of those limits for connections the operator trusts, such as other computers on a local network.
The problem appeared when providers bundled Bitcoin Core with Tor, a service that hides internet addresses. Incoming Tor connections appeared to come from the local Tor software. If that software’s address fell inside a trusted range, outside visitors inherited the permissions too.
The arrangement led to “thousands of reachable mainnet nodes whitelisting all incoming Tor connections,” the advisory said.
Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Core rated it medium severity. Nodes that never enabled the whitelist setting were unaffected.
The high-severity bug involved how a node handles competing versions of the blockchain.
When the network abandons one version, transactions from its discarded blocks can return to the list of pending payments, known as the mempool.
A rule introduced in Bitcoin Core 28.0 could remove one of those restored transactions while leaving behind transactions that depended on it. The node would then try to build blocks containing payments whose inputs were missing, causing its own validity checks to reject them.
An affected mining node could no longer create valid block templates until restarted. Niklas Goegge reported the flaw on Sept. 26, 2025. The advisory does not report any attacks.
The third bug, rated medium, let a malicious connection stall a node’s processing of new blocks for 10 minutes. An attacker controlling all three connections selected for fast block relay could repeat the disruption indefinitely. The advisory also identifies a configuration that only processes blocks as another route to repeated stalling.
Know when your
coins move
Alerts, real-time prices, and market news — all in one app 
Point your phone camera to install 
4.8 based on 40K reviews in the App Store and Google Play 
Source
