Bitcoin Core disclosed on November 10, 2026 that a configuration error in many reachable mainnet nodes caused incoming Tor connections to be treated as trusted peers. The issue, catalogued as CVE‑2025‑62860, granted Tor‑originating nodes exemptions from denial‑of‑service limits and privacy mitigations that are normally reserved for explicitly whitelisted addresses.

BTC / USD
Source: CoinGecko. Prices are indicative.

How the misconfiguration worked

The problem stemmed from a non‑default –whitelist option that some operators used to include the IP address of their local Tor daemon. Because Bitcoin Core identifies an incoming Tor connection by the daemon’s local address rather than the remote onion address, any node with that whitelist inadvertently extended the same privileges to every Tor peer. This meant that thousands of nodes lifted rate‑limiting and privacy protections for all Tor traffic, potentially exposing them to DoS attacks.

Scope and impact

Only nodes that enabled the specific whitelist setting were affected; installations without it remained safe. The advisory notes that popular vendors bundled Bitcoin Core with Tor and a matching whitelist range, and some client software required whitelisting, leading to the widespread exposure. The flaw did not allow wallet access or direct theft of funds, but it weakened network resilience by removing safeguards against abusive traffic.

Remediation and next steps

The vulnerability was patched on September 17 2025, with the fix incorporated into Bitcoin Core 30.0, 29.2 and 28.3 released in October 2025. All subsequent releases, including the current 32.1 maintenance version, contain the correction. Bitcoin Core now advises operators to upgrade to the latest maintenance release and verify that any whitelist does not include the Tor daemon’s address. Versions 28.x and 29.x have reached end‑of‑life, so users should migrate to supported 30.x, 31.x or 32.x branches.

What to watch next

Stakeholders will monitor adoption rates of the patched releases, especially among providers that ship bundled node software. Additional scrutiny may focus on how future Bitcoin Core updates handle Tor integration and whitelist configurations to prevent similar oversights.