Before anyone panics about the Bitcoin Core news: nobody's coins were stolen here, and that's exactly why I think this story still matters.
CoinDesk and KuCoin both reported yesterday that Bitcoin Core disclosed three vulnerabilities on October 28, found by an AI-assisted scan called Project Loupe and verified by human contributors before they went public. Two are rated medium severity, one low, and the fixes are already out in versions 29.5, 30.4, 31.2 and 32.1. The worst of the three let a malicious peer flood a node running Windows, macOS or BSD with network data until it ran out of memory and crashed — Linux nodes escaped that one. The second slowly eats memory the same way, up to 2 MB an hour per inbound peer and 5 MB per outbound peer, and the third is an undo-file overflow that is impractical to exploit on modern 64-bit machines.
So no, this isn't a Bitcoin-is-broken moment. It's a node-availability problem: a crashed node stops validating and relaying until someone restarts it. But the part I'm actually thinking about is the disclosure itself. Until last week, Core sat on medium-severity bugs for up to a year so operators could upgrade quietly. On October 22 it changed that rule for bugs an AI could easily find, because if a scanner can find them cheaply, so can an attacker. That feels like the right call to me — secrecy only works when finding the flaw is hard, and that era is ending.
What I'm watching now is the boring part that actually decides whether this matters: how fast exchanges, wallets and node operators actually upgrade, and whether the three further medium-to-high bugs already fixed in version 30 get disclosed in two weeks as expected. If upgrades lag, the window between public disclosure and patching is where the real risk sits.
Do you run a node, or do you just trust your exchange and wallet to stay current? $BTC
CoinDesk and KuCoin both reported yesterday that Bitcoin Core disclosed three vulnerabilities on October 28, found by an AI-assisted scan called Project Loupe and verified by human contributors before they went public. Two are rated medium severity, one low, and the fixes are already out in versions 29.5, 30.4, 31.2 and 32.1. The worst of the three let a malicious peer flood a node running Windows, macOS or BSD with network data until it ran out of memory and crashed — Linux nodes escaped that one. The second slowly eats memory the same way, up to 2 MB an hour per inbound peer and 5 MB per outbound peer, and the third is an undo-file overflow that is impractical to exploit on modern 64-bit machines.
So no, this isn't a Bitcoin-is-broken moment. It's a node-availability problem: a crashed node stops validating and relaying until someone restarts it. But the part I'm actually thinking about is the disclosure itself. Until last week, Core sat on medium-severity bugs for up to a year so operators could upgrade quietly. On October 22 it changed that rule for bugs an AI could easily find, because if a scanner can find them cheaply, so can an attacker. That feels like the right call to me — secrecy only works when finding the flaw is hard, and that era is ending.
What I'm watching now is the boring part that actually decides whether this matters: how fast exchanges, wallets and node operators actually upgrade, and whether the three further medium-to-high bugs already fixed in version 30 get disclosed in two weeks as expected. If upgrades lag, the window between public disclosure and patching is where the real risk sits.
Do you run a node, or do you just trust your exchange and wallet to stay current? $BTC
