Bitcoin Core Reveals 3 Flaws: Blocked Miners and Thousands of Overconfident Nodes on Tor

Coin Encyclopedia Improve your knowledge of cryptos

The most serious of the three has the number CVE-2025-62861 and the level “high”. It affects versions 28.0 to 28.2 and 29.0 to 29.1 of the software. The culprit is the “sibling eviction” rule introduced with TRUC transactions (a category of transactions with stricter replacement rules designed for Lightning channels). During a chain reorganization, when a block is replaced by a competitor, its transactions return to the mempool, the node's waiting room. Bad surprise. The software could then leave child transactions there that spent missing outputs, and the node became incapable of producing a valid block pattern until restarted. A miner hit would have run idle without understanding why.

Bitcoin Core contributor Niklas Goegge reported the issue on September 26, 2025. The fix arrived in version 30.0 the following October 10, then in 29.2 and 28.3 afterwards. According to the advisory published on bitcoincore.org, no attacks exploiting this flaw have been observed.

The second ( CVE-2025-62860 ) concerns nodes that use the “-whitelist” option, a list of trusted IP addresses exempt from anti-spam limits and privacy protections. When the Tor proxy address fell within a declared range, all incoming Tor connections inherited the privilege. The notice speaks of “thousands of nodes reachable on the main network” which opened the door wide to any stranger passing through Tor. Martin Zumsande and Antoine Poinsot reported the bug on September 12, 2025, and Poinsot privately warned the affected software publishers a week later. Nodes that have never touched this option have not risked anything.

The third ( CVE-2025-62859 ) dates back to April 2025 and a report by Eugene Siegel. A malicious peer who first announced a compact block could freeze the processing of its victim's blocks for ten minutes. The attack became infinitely repeatable if the attacker controlled the three “high-speed” peers of the node, or if it was running in “-blocksonly” mode. Corrected in June 2025 on the main branch, the flaw only disappeared from stable versions with 29.2 and 30.0.

The calendar is no coincidence. Bitcoin Core waits for the latest vulnerable version to be abandoned, then two weeks, before publishing details of a medium or high vulnerability. Branch 29 reached its end of life on October 27, the count is there. This rule, which had already led to the revelation of a severe bug two years after its correction, was relaxed in October. Bugs that are easy to find, including by AI, are now the subject of a corrected version and a notice as quickly as possible. For the user, the instructions are in one number: the latest version is 32.1, published on October 27, and any node remaining in 29.1 or older remains exposed to the three flaws of the day, in addition to those corrected at the end of October.

Falling down the white rabbit hole in 2017, I went from avid reader to Editor-in-Chief of Journal du Coin. I like to get involved behind the scenes of projects to bring my vision of a decentralized future. A lover of beautiful letters, I coordinate our teams to transform technical complexity into human, precise information without unnecessary jargon. Between entrepreneurship and writing, my mission is clear: popularize tomorrow, but do it today.

The news that matters, summarized in 2 minutes. Monday to Friday, in your inbox.

This site uses Google Analytics to collect anonymous information such as the number of visitors to the site and the most popular pages.

Machine-translated from French