CoinDesk
Thousands of reachable Bitcoin nodes granted incoming Tor connections permissions meant for trusted computers, allowing strangers to bypass spam and privacy protections. Bitcoin Core disclosed the medium-severity flaw alongside two other vulnerabilities, including a high-severity bug that could stop an affected mining node from building valid blocks until restarted. All three were patched in October 2025.
Why it matters
The Tor issue arose when incoming connections appeared to originate from local Tor software whose address fell within a node's trusted range. Those connections inherited relaxed limits intended for trusted computers. Nodes that had not enabled the whitelist setting were unaffected.
The mining flaw involved transactions restored to the mempool after blocks were discarded. A rule could remove a transaction while leaving dependent payments behind, causing the node to reject its own invalid block templates. The advisory did not report any attacks.
A third, medium-severity bug allowed a malicious connection to stall new-block processing for 10 minutes. An attacker controlling all three connections selected for fast block relay could repeat the disruption indefinitely.
Market impact
The disclosures concern Bitcoin infrastructure rather than a newly announced network-wide outage. They highlight the importance of node configuration and upgrades for operators, particularly miners whose affected software could stop producing valid block templates.
Bitcoin Core generally waits until after affected releases leave support before publishing detailed advisories, giving operators time to install fixes. Its policy now calls for faster disclosure of flaws that are easy to rediscover.
Frequently asked questions
-
How did Tor connections gain trusted permissions on Bitcoin nodes?
Incoming Tor connections appeared to come from local Tor software. If its address fell within a node's trusted range, outside connections inherited permissions intended for trusted computers.
-
Were all Bitcoin Core nodes affected by the Tor flaw?
No. Nodes that had not enabled the whitelist setting were unaffected.
-
How did the mining vulnerability prevent valid block production?
A rule could remove a restored transaction while leaving dependent payments in the mempool. The affected node would then reject its own invalid block templates until restarted.
-
Could attackers repeatedly stall Bitcoin block processing?
The third flaw allowed a malicious connection to stall processing for 10 minutes. An attacker controlling all three connections selected for fast block relay could repeat the disruption indefinitely.
-
Why did Bitcoin Core publish details after the fixes?
Bitcoin Core generally waits until after affected releases leave support before publishing detailed advisories, giving operators time to upgrade. All three disclosed flaws were patched in October 2025.
TheBlock
CoinTelegraph
Lookonchain
WuBlockchain
CryptoSlate
Crypto News
Glassnode