Bitcoin Core Discloses Tor Trust Flaw and Mining Node Bug, Patched in October
Bitcoin Core published security advisories on November 10 covering three vulnerabilities, including CVE-2025-62860, which granted trusted-peer permissions to incoming Tor connections on some nodes. The flaws were patched in October releases, and affected operators are being told to update their software.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What the Advisories Disclose
Bitcoin Core published its security disclosure on November 10, identifying three vulnerabilities, all fixed in releases shipped in October. The most prominent is CVE-2025-62860, which allowed incoming Tor connections to receive trusted-peer permissions on thousands of reachable mainnet nodes. A second, CVE-2025-62861, rated high severity, could stop a mining node from producing blocks until it was restarted. A third, CVE-2025-62859, rated medium severity, concerns compact block relay. The disclosure was released after the 29.x release series reached end of support on October 27.
The Tor Whitelist Flaw
According to the advisory, incoming Tor peers appeared to Bitcoin Core under the IP address of the local Tor software, which typically runs on the same machine or network. When that address fell within a range set through the optional -whitelist option, outside connections inherited permissions meant for trusted peers. Those permissions remove certain denial-of-service limits and protections against leaking private information. Popular vendors bundled Bitcoin Core with Tor and configured matching whitelist ranges, which is why the exposure reached thousands of nodes. Nodes that never enabled the non-default setting were not affected.
The bug was reported to the security team on September 12, 2025 by Martin Zumsande and Antoine Poinsot, and the fix, which excludes incoming onion connections from whitelist permissions, was merged on September 17. Software providers were notified two days later. Bitcoin Core 30.0 shipped the fix on October 10, followed by 29.2 on October 14, and the advisory lists 28.3 and later minor releases as patched.
The Mining Node Reorganization Bug
CVE-2025-62861 affected versions 28.0 through 28.2 and 29.0 through 29.1. It arises during chain reorganizations, when transactions from disconnected blocks return to the mempool, the node's pool of pending transactions. Version 3 transactions, known as TRUC transactions, normally limit relationships between unconfirmed transactions, and returning transactions are supposed to bypass those limits during a reorg. A transaction replacement rule remained active in that process, which could remove a restored transaction while leaving dependent transactions behind. The resulting inconsistent mempool caused block templates to fail validation, and block production could not resume until a restart reloaded the mempool. Niklas Goegge reported the issue on September 26, 2025, and the correction was merged on October 2. Developer Greg Sanders explained in the fix documentation that skipping TRUC checks during reorgs was the intended behavior, but the relevant bypass argument had not been checked.
Compact Block Stalling
CVE-2025-62859 is a medium-severity issue in compact blocks, a bandwidth-saving method for relaying blocks between nodes. A malicious peer that announces a compact block first can cause a victim to request the full block from that same peer and wait out a 10-minute timeout, after a failed check on altered transaction witness data. According to the disclosure, an attacker controlling all three of a victim's high-bandwidth peers could repeat the stall indefinitely. Nodes running with -blocksonly were also susceptible to repeated stalling. Eugene Siegel reported the flaw on April 28, 2025.
Disclosure Timing
Bitcoin Core's disclosure policy generally holds medium- and high-severity details until two weeks after the last affected release reaches end of life. The published timeline shows the Tor fix was merged roughly seven weeks before public disclosure, and the mining fix roughly five weeks before. Source reporting differs on how to characterize the timing: CoinDesk describes the Tor flaw as having been kept quiet until Tuesday, while Crypto.news frames the disclosure as the developers releasing details alongside the other two vulnerabilities after the 29.x end-of-support date. Both accounts agree on the patch dates and the end-of-support trigger, and the advisories themselves do not characterize the disclosure as delayed beyond policy.
Operators running affected versions or whitelist configurations are the primary audience for the advisory, and the patched releases are the documented remediation path.
Why It Matters
For Traders
The bugs are patched and the mining issue affected only specific version ranges, so near-term price impact is likely limited, though miners on affected releases should be checked.
For Investors
Disclosures of this kind highlight the security review process Bitcoin Core applies to its codebase, a factor relevant to long-horizon confidence in node software.
For Builders
Anyone whose services rely on -whitelist or Tor peer trust should audit configuration and confirm they run 30.0, 29.2, or 28.3-plus releases.
This article is for information only and is not financial advice. Read the full disclaimer.
