Bitcoin Core disclosed a vulnerability affecting providers that bundle Bitcoin Core with Tor, according to an Odaily report citing a Bitcoin News post on X. In that setup, incoming Tor traffic could be treated as local traffic. Nodes with whitelisting enabled could then relax spam and privacy restrictions for external nodes, allowing those nodes to inherit “trusted” status across thousands of nodes.
The fix was released in October 2025. Bitcoin Core disclosed the details two weeks after support for the 29.x series ended. Nodes without whitelisting enabled were not affected, the report said.
The report also described a separate high-severity vulnerability that could prevent mining nodes from constructing valid blocks until they were restarted. It said no related attacks had been reported.
Originally reported by Odaily on November 13, 2026, at 22:29 (UTC+8).