Thousands of Bitcoin nodes gave anonymous strangers a pass around security limits
Summary
Bitcoin Core disclosed CVE-2025-62860, a medium-severity configuration flaw that could make incoming Tor peers appear trusted when a node’s non-default whitelist included the Tor daemon’s IP address. Those peers then bypassed some denial-of-service limits and privacy protections; the flaw did not grant wallet access or enable coin theft. Bundled software configurations exposed thousands of reachable mainnet nodes historically, but that is not a count of nodes still vulnerable. A patch merged in September 2025 and shipped in Bitcoin Core 30.0, 29.2 and 28.3 in October. Operators should check their running version and whitelist configuration, and upgrade to a supported release.
