← The Polylog Crypto Intelligence Brief
Morning Edition · Thursday, November 12, 2026Published at 12:46 AM EST · New York
Bitcoin Core Discloses Three Patched Bugs, Including One That Let Thousands of Nodes Trust Any Tor Peer
A second, high-severity flaw could stop mining nodes from building block templates after a chain reorganization until someone restarted them, and the project kept both bugs private for about 13 months after fixing them.
On Tuesday, Bitcoin Core's maintainers published advisories for three vulnerabilities that they had fixed in October 2025 and kept private until now. Bitcoin Core is the reference software that most of the network's nodes run. The disclosure came after the 29.x release line reached end of life on October 27, 2026. Outlets covering the advisories describe that date as the trigger, because the project's policy is to publish such bugs only after the last affected release line stops receiving support.
The most serious of the three, rated High and tracked as CVE-2025-62861, affected how mining nodes build block templates. A block template is the candidate block a miner works on. According to the advisory as reported, nodes running versions 28.0 through 28.2 or 29.0 through 29.1 could lose the ability to build templates after a chain reorganization involving TRUC transactions. TRUC (topologically restricted until confirmation) is a newer transaction-relay policy. A node in that state stayed stuck until an operator restarted it manually. Developer Niklas Gögge reported the bug on September 26, 2025, and fixes shipped in versions 30.0, 29.2 and 28.3 that October. The French-language channel Goku Crypto News summarized the risk as a mempool malfunction that could prevent some miners from producing new blocks. No outlet reported active exploitation.
The Medium-rated Tor issue reached more machines. CoinDesk reports that thousands of reachable mainnet nodes had been whitelisting incoming Tor connections. Whitelisting is the status a node normally grants only to peers it controls. It removed denial-of-service limits and some privacy protections for any stranger who connected over Tor. The third bug, also Medium, could delay block processing. Coverage disagrees on which CVE number belongs to which of the two Medium issues and on who reported each one, so readers should check the project's advisories index for the mapping. One report estimates that about 9% of reachable nodes still advertised vulnerable versions when the advisories went out. Other coverage puts the practical exposure close to zero, because miners upgrade faster than hobbyist nodes.
What this means
The exposure sits with mining pools that run older Core versions and with privacy-sensitive node operators who rely on Tor. A stuck template does not create invalid blocks. It stops a pool from mining until a person intervenes, so a deliberate reorganization combined with crafted TRUC transactions could have cost an unpatched pool revenue and briefly reduced the network's hashrate. The Tor whitelisting flaw matters more for the network's structure. Tor exists so that node operators can hide their location, and those were the operators who lost denial-of-service protection. The coordinated, delayed disclosure worked as designed, and the market will not price it. The useful signal is the batch itself. In July 2024 Bitcoin Core began publishing old advisories under its new policy, and each end-of-life date since has released another batch. The desk expects this cycle to continue: more Medium and High bugs disclosed at each end-of-life date over the coming months, with no change to bitcoin's monetary rules. The forward read depends on fixes continuing to ship before anyone exploits the bugs. A Core bug exploited in the wild before its patch, or a consensus-level defect rather than a node-level one, would prove it wrong.
Part of a tracked trend
Unaudited Open-Source Crypto Code Surfaces at Scale
Coordinated volunteer and AI-assisted review keeps exposing large backlogs of undiscovered defects in the open-source libraries that wallets, nodes and protocols depend on, so disclosure waves — not novel attacker research — become a recurring driver of emergency patches and incident risk across the ecosystem.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Bitget Hacker Pushes 80% of $78.6 Million in Bitcoin Through CoinJoin as Exchange Breaches Point to Withdrawal Systems
- Miden Bundles Private Stablecoin Finance Into a "PriFi" Stack as Researchers Bring Zcash Payment Proofs to Base
- Nvidia Perpetual Futures Fall 7% on Hyperliquid After Reports Its Board May Remove Jensen Huang
- Russia's Central Bank Clears Exchanges to Begin Organized Crypto Trading From November 22
- Stablecoin Supply Falls $14.2 Billion in a Month as Bitcoin Holds Near $73,700 After Hotter Inflation Data
- MSCI Drops Strategy and Four Other Treasury Companies From Its Indexes as BitMine Reports a Yearly Loss Above $6 Billion
- Ajna Founders Argue a Fully Backed Stablecoin Cannot Protect DeFi Lenders From Token Votes
Comments
2Nov 12, 5:46 AM
Because disclosure waits for the last affected line to reach end of life, any miner still on 28.0 through 28.2 or 29.0 through 29.1 now runs a publicly documented flaw that only an upgrade removes.
Nov 12, 2:00 PM
The 13 month delay is Bitcoin Core policy, which holds medium and high severity bugs until the last vulnerable release reaches end of life, so remaining exposure sits on nodes running unmaintained versions.