Browse

Reference

Directory

Company

Help & Legal

Follow

Subscribe

Quick Take

Bitcoin Core disclosed a configuration flaw on Nov. 10 that caused thousands of reachable Bitcoin mainnet nodes to treat incoming Tor connections as trusted peers, giving them exemptions from denial-of-service limits and privacy protections.

The project rated CVE-2025-62860 medium severity. It affected vulnerable releases when a non-default -whitelist setting covered the IP address of the node's Tor daemon, the software handling its Tor connections. Nodes that never enabled that setting were never affected.

The fixes shipped in October 2025. The new disclosure explains how a configuration intended for trusted connections spread through bundled software and granted those privileges to remote Tor peers.

Bitcoin Core speeds up security fixes as 44% of surveyed nodes run unsupported versions

For an incoming Tor connection, Bitcoin Core sees the Tor daemon's IP address rather than the remote peer's actual network address. That daemon usually runs on the same machine or local network.

On affected configurations, Core checked that address against an IP range marked as trusted. If the range included the daemon, incoming Tor connections inherited the whitelist permissions. The local address identified the intermediary carrying the connection, but could not establish which remote peer deserved trust.

How Tor peers inherited local trust

On vulnerable configurations, an IP whitelist trusted the local Tor daemon's address and passed exemptions to incoming remote peers.

What changes at the trust check

A vulnerable release used the daemon's matching IP range to grant trusted-peer exemptions.

Incoming onion connections bypass address-based whitelist matching, preventing this mistaken grant.

The patch excludes incoming onion connections from address-based whitelist grants.

Before-fix state requires a vulnerable release and a non-default whitelist matching the Tor daemon. The change concerns address-based -whitelist permissions, not every possible peer permission.

Sources

Supporting facts

Method

Qualitative connection path plus two reported states. Peer markers illustrate multiple remote connections and encode no count or scale.

Scope

That distinction matters because -whitelist lifts various limits intended to restrict denial-of-service behavior, along with mitigations against privacy leaks. The issue concerned exemptions granted to network peers; the privileges described in the disclosure do not establish wallet access or coin theft.

Bitcoin Core’s privacy fix reaches v32 code while the v31 patch remains open

Bitcoin Core says popular vendors bundled the node software with Tor and a matching whitelist range. Some client software also required whitelisting and commonly ran alongside Tor. Together, these configurations led thousands of reachable mainnet nodes to whitelist every incoming Tor connection.

That is the advisory's historical exposure finding, not a count of nodes still vulnerable today.

Martin Zumsande and Antoine Poinsot reported the issue in September 2025. The patch merged on Sept. 17 and stopped applying address-based whitelist permissions to incoming onion connections, whose remote network addresses are concealed.

Bitcoin Core 30.0, 29.2 and 28.3 shipped the fix in October 2025. The fix is present in all versions from 30.0 onward, as well as later minor releases in the fixed 28.x and 29.x branches.

Bitcoin developers rush to fix 3 security flaws after AI uncovers them

What node operators should check now

Those older patch thresholds are separate from today's upgrade guidance. Bitcoin Core's maintenance schedule now covers 30.x, 31.x and 32.x; 28.x and 29.x have reached end of life. The project recommends the latest maintenance release of the newest major version an operator can adopt. Its download page lists 32.1 as latest as of Nov. 11.

For operators using packaged node software, check the Bitcoin Core version actually running and whether its whitelist range includes the Tor daemon's address.

Mentioned in this article

Buying Bitcoin without betting on a rally may not pay

Cookie Consent

We use cookies to improve your experience on our site. By using our site, you consent to cookies.

Cookie Preferences

Manage your cookie preferences below:

Essential cookies enable basic functions and are necessary for the proper function of the website.

CloudFlare provides web performance and security solutions, enhancing site speed and protecting against threats.

Service URL: developers.cloudflare.com (opens in a new window)

Google Analytics is a powerful tool that tracks and analyzes website traffic for informed marketing decisions.

Service URL: policies.google.com (opens in a new window)

Statistics cookies collect information anonymously. This information helps us understand how visitors use our website.

Clarity is a web analytics service that tracks and reports website traffic.

Service URL: clarity.microsoft.com (opens in a new window)

You can find more information in our Privacy Policy and .

Loading image…

This image could not be loaded.

The Catalyst