Bitcoin Core discloses configuration flaw affecting thousands of nodes

Bitcoin Core has officially disclosed a security configuration flaw that resulted in thousands of reachable mainnet nodes inadvertently treating incoming Tor connections as trusted peers. This issue, identified as CVE-2025-62860 and rated as medium severity, allowed these anonymous connections to bypass standard denial-of-service limits and privacy protections. The incident highlights how thousands of Bitcoin nodes were configured to grant exemptions to remote peers based on the IP address of their own local Tor daemon.

Understanding the thousands of Bitcoin nodes issue

The vulnerability occurred when a non-default whitelist setting was applied to the IP address of a node's Tor daemon. Because the Bitcoin Core software identifies incoming Tor traffic by the IP address of the local daemon—which typically runs on the same machine or network—the system incorrectly matched this address against the whitelist. Consequently, every incoming Tor connection inherited the elevated permissions intended for trusted network peers. It is important to note that while this configuration bypassed security limits, it did not grant access to user wallets or facilitate the theft of coins.

Bitcoin Core reported that the issue was exacerbated by popular software vendors who bundled their node packages with a pre-configured Tor setup and a matching whitelist range. Some client software that required whitelisting and operated alongside Tor also contributed to the problem. The project clarified that this discovery represents a historical exposure finding rather than a current count of vulnerable nodes.

A configuration flaw allowed thousands of Bitcoin nodes to grant unintended security exemptions to Tor connections.

The vulnerability was reported in September 2025 by researchers Martin Zumsande and Antoine Poinsot. A patch was merged on September 17, 2025, which effectively stopped the application of address-based whitelist permissions to incoming onion connections. These fixes were officially shipped in October 2025 within Bitcoin Core versions 30.0, 29.2, and 28.3. Users are encouraged to check their current version and ensure their whitelist ranges do not include the Tor daemon's address.

Why it matters

This disclosure serves as a critical reminder for node operators to verify their configurations, especially when using bundled software packages. While versions 28.x and 29.x have reached their end-of-life, the project advises operators to adopt the latest maintenance release of the newest major version, such as 32.1, to ensure ongoing security and stability.

For the global community, including those in India and South Asia managing node infrastructure, this update underscores the importance of maintaining software updates and auditing security settings. By ensuring that whitelist configurations are strictly managed, operators can protect their nodes from potential denial-of-service risks and maintain the integrity of their network participation.