🚨Tor wasn't broken. Bitcoin Core trusted the wrong address.
#bitcoincoredisclosestortrafficvulnerability
On November 10, Bitcoin Core disclosed medium-severity CVE-2025-62860. In certain configurations, an inbound Tor peer appeared to the node as its local Tor daemon. If that daemon's IP matched a non-default -whitelist range, incoming onion peers could inherit trusted-peer permissions that relax denial-of-service limits and some privacy protections.
Bitcoin Core says vendor bundles and common Tor configurations left thousands of reachable mainnet nodes exposed. But nodes without the optional whitelist setting were never affected.
This was not a break of Tor encryption, a Bitcoin consensus failure or proof that users' real IP addresses were exposed.
The more overlooked story: the Tor bug was one of three vulnerabilities disclosed together. CVE-2025-62861, rated high severity, could leave an affected mining node unable to build block templates after a chain reorganization until restart. CVE-2025-62859 could stall block processing under specific peer conditions.
The fixes shipped in 2025. The detailed disclosure arrived November 10, two weeks after the last affected 29.x branch reached end-of-life on October 27, following Bitcoin Core's published security policy.
The lesson: network security can fail through configuration assumptions, not just cryptographic flaws.
Not financial advice.
$BTC
#BitcoinCoreDisclosesTorTrafficVulnerability #BitcoinCore #BitcoinBreaksBelow200WeekMovingAverage #NodeSecurity
#bitcoincoredisclosestortrafficvulnerability
On November 10, Bitcoin Core disclosed medium-severity CVE-2025-62860. In certain configurations, an inbound Tor peer appeared to the node as its local Tor daemon. If that daemon's IP matched a non-default -whitelist range, incoming onion peers could inherit trusted-peer permissions that relax denial-of-service limits and some privacy protections.
Bitcoin Core says vendor bundles and common Tor configurations left thousands of reachable mainnet nodes exposed. But nodes without the optional whitelist setting were never affected.
This was not a break of Tor encryption, a Bitcoin consensus failure or proof that users' real IP addresses were exposed.
The more overlooked story: the Tor bug was one of three vulnerabilities disclosed together. CVE-2025-62861, rated high severity, could leave an affected mining node unable to build block templates after a chain reorganization until restart. CVE-2025-62859 could stall block processing under specific peer conditions.
The fixes shipped in 2025. The detailed disclosure arrived November 10, two weeks after the last affected 29.x branch reached end-of-life on October 27, following Bitcoin Core's published security policy.
The lesson: network security can fail through configuration assumptions, not just cryptographic flaws.
Not financial advice.
$BTC
#BitcoinCoreDisclosesTorTrafficVulnerability #BitcoinCore #BitcoinBreaksBelow200WeekMovingAverage #NodeSecurity
