LOL, today a bunch of people on the timeline were shouting, “Bitcoin has a backdoor!” I clicked in to take a look—and wow, the vulnerability is real, but the locks were changed back in October last year.
Bitcoin Core just disclosed it: CVE-2025-62860. Under certain configurations, Tor nodes could mistake incoming Tor traffic for their own local connections and treat it as “trusted,” bypassing spam defenses. Thousands of nodes were affected. Sounds scary, right?
But here’s the twist: nodes using the default configuration were completely unaffected, not a single coin was lost, there wasn’t a single known attack, and all three bugs were fixed in versions 28.3, 29.2, and 30.0 in October 2025. So the locks were changed last year, and only this year did they tell us the door hadn’t been properly secured.
On one side, clickbait headlines: “Backdoor,” “Privacy compromised,” “Run!”—they can’t wait for you to sell right now. On the other, the unruffled crowd: It’s already fixed, and transparency is a good thing. What’s there to panic about?
I’m with the latter, but there’s a caveat: 13 months passed between the fix and the disclosure. Fixing it first and announcing it later is responsible, but during those 13 months, nodes running old versions were left in the dark and exposed for a whole year. Transparency is good, but being slow to be transparent is a problem too.
So here’s my take: the coins are safe, and don’t let the headlines scare you into selling. But next time, can you tell us before a whole year has passed? The nodes belong to everyone, not just the developers’ diary.
Which side are you on: do you think “fixing it and disclosing it a year later” is responsible, or should they have spoken up sooner?
#BTC
Bitcoin Core just disclosed it: CVE-2025-62860. Under certain configurations, Tor nodes could mistake incoming Tor traffic for their own local connections and treat it as “trusted,” bypassing spam defenses. Thousands of nodes were affected. Sounds scary, right?
But here’s the twist: nodes using the default configuration were completely unaffected, not a single coin was lost, there wasn’t a single known attack, and all three bugs were fixed in versions 28.3, 29.2, and 30.0 in October 2025. So the locks were changed last year, and only this year did they tell us the door hadn’t been properly secured.
On one side, clickbait headlines: “Backdoor,” “Privacy compromised,” “Run!”—they can’t wait for you to sell right now. On the other, the unruffled crowd: It’s already fixed, and transparency is a good thing. What’s there to panic about?
I’m with the latter, but there’s a caveat: 13 months passed between the fix and the disclosure. Fixing it first and announcing it later is responsible, but during those 13 months, nodes running old versions were left in the dark and exposed for a whole year. Transparency is good, but being slow to be transparent is a problem too.
So here’s my take: the coins are safe, and don’t let the headlines scare you into selling. But next time, can you tell us before a whole year has passed? The nodes belong to everyone, not just the developers’ diary.
Which side are you on: do you think “fixing it and disclosing it a year later” is responsible, or should they have spoken up sooner?
#BTC
