Bitcoin Core bug let strangers connecting over Tor inherit “trusted” status on thousands of nodes A vulnerability in Bitcoin Core allowed strangers who connected via Tor to bypass spam and privacy protections on thousands of nodes by being treated as if they were trusted peers. Bitcoin Core published a formal security advisory on Tuesday — roughly 13 months after the fix was released — noting that the corrective code had been visible on GitHub since September 2025 under a clear warning that whitelist permissions should not apply to incoming Tor connections. How it happened - A Bitcoin node normally limits how much traffic its peers can send to defend against spam and denial-of-service attempts. Operators can relax those limits for specific peers using a whitelist setting, for example to trust other machines on a local network. - The bug appeared when distributions bundled Bitcoin Core with Tor, the privacy network that hides IP addresses. Incoming Tor connections were reported as if they originated from the local Tor software. If that local Tor address was inside a trusted range, remote Tor visitors inadvertently inherited the relaxed, “trusted” permissions. Wider context and additional fixes - The advisory disclosed this issue as one of three bugs announced Tuesday. All three were fixed in releases shipped last October. One of the other bugs could cause a mining node to stop building blocks until its operator restarted the node. - The potentially wide impact stems from the common practice of running Bitcoin Core together with Tor to preserve node operator privacy. What operators should do - Nodes still running unpatched releases should upgrade to the versions that include last October’s fixes to ensure whitelist and Tor behavior is correct and to pick up the other patches. This disclosure highlights how subtle interactions between privacy tooling and network configuration can undermine intended protections unless software treats anonymizing proxies like Tor explicitly and cautiously. Read more AI-generated news on: https://app.chaingpt.org/news