Bitcoin Core developers have publicly disclosed three previously patched security vulnerabilities, including a high-severity software flaw that could have prevented affected Bitcoin miners from creating new blocks until their nodes were restarted. The most serious vulnerability, identified as CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1 and involved an error in how the software handled transactions following a blockchain reorganization. Two additional medium-severity vulnerabilities could allow malicious network participants to delay block processing or bypass certain privacy and denial-of-service protections on nodes connected through Tor. All three flaws were fixed in software updates released in October 2025, but their technical details were not publicly disclosed until November 10, 2026, under Bitcoin Core’s coordinated vulnerability disclosure policy. Developers reported no evidence that the vulnerabilities had been exploited, and none allowed attackers to steal Bitcoin, create unauthorized coins or compromise the network’s underlying consensus rules. The disclosure comes as Bitcoin developers are also revising their security procedures to address vulnerabilities that artificial intelligence tools may make easier for attackers to discover.
Bitcoin Core Reveals Three Security Vulnerabilities
The Bitcoin Core development team published three security advisories on November 10, detailing software vulnerabilities that had already been addressed in previous releases.
Bitcoin Core is the reference software implementation used by many computers participating in the Bitcoin network. These computers, commonly called nodes, verify transactions, enforce Bitcoin’s consensus rules and communicate blockchain information to other participants.
Mining operations also rely on node software to assemble valid blocks containing pending transactions.
The newly disclosed vulnerabilities affected different parts of that infrastructure, including mining operations, block processing and network connection permissions.
Bitcoin Core classified one vulnerability as high severity and the other two as medium severity.
The Three Disclosed Vulnerabilities
| Vulnerability | Severity | Potential impact |
|---|---|---|
| CVE-2025-62861 | High | Prevents an affected mining node from creating valid block templates after certain blockchain reorganizations |
| CVE-2025-62859 | Medium | Allows malicious peers to delay block processing, potentially repeatedly |
| CVE-2025-62860 | Medium | Incorrectly grants trusted permissions to certain incoming Tor connections |
The vulnerabilities were operational and security weaknesses rather than flaws that allowed unauthorized Bitcoin creation or direct theft of cryptocurrency.
Developers emphasized that the issues had been fixed before their technical details were publicly released.
The disclosures nevertheless highlight how software vulnerabilities can affect the reliability of individual Bitcoin network participants.
High-Severity Mining Bug Could Prevent New Block Creation
The most serious vulnerability, CVE-2025-62861, involved the process Bitcoin miners use to construct new blocks.
Bitcoin mining requires specialized computers to perform calculations in an effort to discover a valid block.
Before miners begin that work, their node software must assemble a block template containing eligible transactions and other required information.
The template provides the foundation for the mining process.
If the node cannot create a valid template, the mining operation may be unable to produce a new valid block using that software.
The vulnerability could cause exactly that problem under certain circumstances.
Following a blockchain reorganization, affected versions of Bitcoin Core could incorrectly remove transactions from the node’s memory pool while retaining other transactions that depended on them.
This could leave the node’s transaction records in an inconsistent state.
When the mining software attempted to construct a new block, its own validation checks would reject the proposed block template.
As a result, the affected miner could become unable to generate new valid block templates until the node was restarted.
The vulnerability affected these Bitcoin Core releases:
Version 28.0
Version 28.1
Version 28.2
Version 29.0
Version 29.1
The problem did not mean the entire Bitcoin network would automatically stop mining.
Instead, it could disrupt individual miners or mining operations relying on affected node software.
Other miners running unaffected software could continue producing valid blocks.
How a Blockchain Reorganization Triggered the Mining Flaw
Understanding the vulnerability requires examining how Bitcoin handles competing versions of its blockchain.
A blockchain reorganization, commonly called a chain reorg, occurs when a node switches from one valid chain of blocks to another chain with more accumulated proof-of-work.
Reorganizations can occur naturally when miners discover competing blocks around the same time.
When a node adopts a different chain, transactions from blocks that are no longer part of the active blockchain may need to return to its pool of unconfirmed transactions.
That pool is called the mempool.
The mempool acts as a temporary holding area for transactions waiting to be included in future blocks.
Bitcoin Core normally applies rules governing which transactions can enter the mempool and how related transactions are handled.
However, transactions returning after a blockchain reorganization require special treatment.
The vulnerability occurred because a particular transaction replacement rule continued operating when it should have been bypassed.
How the Bug Could Disrupt a Miner
A blockchain reorganization occurs. The node switches to a different valid chain.
Transactions return to the mempool. Transactions from disconnected blocks are reconsidered for inclusion in future blocks.
A transaction is incorrectly removed. A software rule removes a transaction while leaving behind other transactions that depend on it.
The mempool becomes inconsistent. The node retains dependent transactions whose required inputs are no longer available.
Block template validation fails. The mining software attempts to assemble a block containing invalid transaction relationships.
Mining operations are interrupted. The affected node cannot create valid new block templates until it is restarted.
The underlying issue involved TRUC transactions, also known as version 3 transactions, and a mechanism called sibling eviction.
Sibling eviction is designed to manage certain transaction replacement situations within Bitcoin Core’s mempool.
The flaw occurred when those rules interacted incorrectly with transaction restoration following a chain reorganization.
Although the technical circumstances were specific, the potential consequence was significant for miners relying on the affected software.
Security Researcher Reported Mining Vulnerability in September 2025
The mining flaw was privately reported by security researcher Niklas Goegge on September 26, 2025.
Bitcoin Core developers subsequently developed and integrated a correction.
The fix was included in the project’s October 2025 software releases.
This timeline is important because the vulnerability was not newly discovered in November 2026.
Instead, November’s announcement represented the public disclosure of an issue that developers had already investigated and repaired.
The distinction reflects a common practice in cybersecurity.
Researchers often report vulnerabilities privately to software maintainers so that fixes can be developed before technical details become widely available.
For software supporting financial infrastructure, coordinated disclosure can reduce the opportunity for attackers to exploit weaknesses before users have time to update.
Bitcoin Core followed that approach for the three vulnerabilities announced this week.
Second Vulnerability Could Delay Bitcoin Block Processing
The second vulnerability, CVE-2025-62859, affected how Bitcoin Core processed certain incoming blocks.
The issue was classified as medium severity.
Bitcoin nodes exchange information about newly discovered blocks to keep participants synchronized with the network.
One mechanism used to improve efficiency involves compact blocks, which reduce the amount of information that must be transmitted between peers.
However, the vulnerability allowed a malicious peer to manipulate transaction witness data in a way that interfered with this process.
Under the affected conditions, an attacker could cause a node to delay processing a block for up to 10 minutes.
In certain configurations, the attack could be repeated indefinitely.
The vulnerability was particularly relevant to nodes operating in -blocksonly mode or nodes whose three high-bandwidth block-relay peers were controlled by an attacker.
Potential Consequences
Delayed block validation: An affected node could take longer to process newly received blocks.
Reduced synchronization reliability: Repeated delays could interfere with the node’s ability to stay current with the blockchain.
Operational disruption: Services relying on the affected node might experience delayed blockchain information.
Repeatable interference: Under specific conditions, an attacker could repeatedly trigger the processing delay.
The vulnerability was reported by security researcher Eugene Siegel in April 2025.
Developers subsequently addressed the problem in patched Bitcoin Core releases.
Importantly, the flaw did not allow an attacker to change Bitcoin’s consensus rules or create fraudulent coins.
Its primary impact involved the availability and responsiveness of affected nodes.
Tor Security Bug Exposed Thousands of Bitcoin Nodes
The third vulnerability, CVE-2025-62860, involved Bitcoin nodes configured to receive connections through Tor.
Tor is a privacy-focused network that helps conceal internet addresses and provides an additional layer of anonymity for online communications.
Bitcoin node operators may use Tor to reduce the exposure of their network locations.
However, the vulnerability caused certain incoming Tor connections to receive permissions intended only for trusted peers.
Bitcoin Core includes an optional whitelist setting that allows operators to designate trusted network addresses.
Whitelisted peers can receive exemptions from some restrictions normally applied to untrusted connections.
The problem occurred when a node’s whitelist configuration included the address used by its local Tor proxy.
Because incoming Tor connections appeared to originate from that proxy, outside peers could mistakenly inherit trusted permissions.
This weakened certain protections intended to limit malicious network activity.
Security Protections That Could Be Affected
Denial-of-service safeguards: Restrictions intended to prevent abusive network traffic could be bypassed.
Peer management controls: Untrusted connections could receive permissions intended for trusted systems.
Privacy protections: Certain safeguards associated with network communications could be weakened.
Connection restrictions: Affected nodes could treat outside Tor connections more permissively than intended.
According to Bitcoin Core’s security advisory, thousands of reachable Bitcoin mainnet nodes had configurations that could grant these unintended permissions.
However, the vulnerability depended on the optional whitelist setting.
Nodes that did not enable the affected configuration were not exposed to this specific issue.
The flaw was reported by Martin Zumsande and Antoine Poinsot in September 2025.
Developers subsequently corrected the handling of trusted permissions for incoming Tor connections.
Bitcoin Core Released Security Fixes in October 2025
Although the vulnerabilities were publicly disclosed in November 2026, the fixes were available more than a year earlier.
Bitcoin Core released updates addressing the issues in October 2025.
The most important patched releases included:
| Bitcoin Core release | Release date | Security fixes |
|---|---|---|
| 30.0 | October 10, 2025 | Fixes all three disclosed vulnerabilities |
| 29.2 | October 14, 2025 | Fixes all three disclosed vulnerabilities |
| 28.3 | October 2025 | Fixes the high-severity mining vulnerability |
The availability of patches before disclosure gave node operators an opportunity to update their systems without knowing the full technical details of the vulnerabilities.
For miners, upgrading to a patched version addresses the underlying block-template problem.
Restarting an affected node could restore its ability to construct valid templates temporarily, but a restart alone would not permanently remove the software vulnerability.
Installing a patched Bitcoin Core release is the appropriate long-term solution.
Node operators should also review their network configurations, particularly if they use Tor or custom whitelist settings.
Running current, supported software helps ensure that previously disclosed security issues remain addressed.
Why Bitcoin Core Waited More Than a Year to Reveal the Bugs
The timing of the public disclosure may initially appear unusual.
The vulnerabilities were reported and fixed in 2025, yet their technical details were not published until November 2026.
The delay was consistent with Bitcoin Core’s established security disclosure policy.
For certain medium- and high-severity vulnerabilities, developers traditionally wait until affected software releases have reached the end of their supported lifespan before publishing detailed advisories.
The objective is to reduce the number of vulnerable systems still in operation when attackers gain access to technical information about a flaw.
According to reporting on the advisories, the final affected release series reached end-of-life status on October 27, 2026.
The public disclosure followed approximately two weeks later, on November 10.
This approach differs from immediate public disclosure, which can provide transparency but may also expose systems before their operators have installed available fixes.
Bitcoin Core’s policy attempts to balance those competing concerns.
However, recent developments in artificial intelligence have prompted developers to reconsider whether long disclosure delays remain appropriate for every type of vulnerability.
Bitcoin Core Changes Security Policy as AI Makes Bugs Easier to Discover
The vulnerability disclosures come shortly after Bitcoin Core revised its security policy to account for advances in artificial intelligence.
In October 2026, developers introduced a new category for vulnerabilities considered easily discoverable.
These include software weaknesses that attackers might identify or rediscover using relatively simple methods, potentially including prompts submitted to large language models.
The concern is that AI-assisted code analysis can reduce the time and expertise required to identify certain programming mistakes.
Traditionally, withholding detailed vulnerability information could make it harder for attackers to discover a flaw.
However, that strategy becomes less effective when publicly available source code and AI tools make the weakness easier to uncover independently.
Bitcoin Core’s revised approach allows developers to patch and disclose easily discoverable vulnerabilities more quickly.
Key Changes to the Security Approach
Faster disclosure: Easily discoverable vulnerabilities can be publicly disclosed alongside their fixes.
Expedited security releases: Developers can prioritize patches across actively maintained software branches.
AI-aware risk assessment: Vulnerability discoverability can account for the capabilities of modern AI tools.
Reduced reliance on long embargoes: Developers may avoid extended secrecy when a flaw is already straightforward to identify.
Continued coordinated disclosure: Other vulnerabilities can still follow the project’s established severity-based timetable.
Bitcoin Core developer Antoine Poinsot has discussed the need to adapt security practices as AI changes the economics of vulnerability discovery.
The policy reflects a broader challenge facing open-source software projects.
Publicly accessible source code allows independent researchers to inspect systems and identify weaknesses, but it also gives potential attackers access to the same material.
AI tools may increase the speed at which both groups can analyze code.
Bitcoin Red Team Uses AI to Find Vulnerabilities Before Attackers
Bitcoin’s broader development community has also been exploring AI-assisted security research.
A volunteer initiative known as the Bitcoin Red Team has been working to identify vulnerabilities that may be discoverable using modern AI tools.
The initiative reflects growing interest in applying artificial intelligence to defensive cybersecurity.
AI-assisted systems can help researchers review code, identify unusual interactions between software components and generate potential test cases.
These capabilities may be particularly useful for complex projects such as Bitcoin Core, which must handle networking, transaction validation, mempool management and consensus-related operations.
However, AI-generated findings require careful verification.
Automated tools can produce false positives or misunderstand how software components interact.
Human developers and security researchers remain responsible for determining whether a reported issue represents a genuine vulnerability.
The broader objective is to identify and repair weaknesses before they can be exploited.
For Bitcoin, these efforts are especially important because the network depends on software operated by independent participants around the world.
Did the Vulnerabilities Put Bitcoin Holders’ Funds at Risk?
One of the most important distinctions in the disclosure is that none of the three vulnerabilities enabled direct Bitcoin theft or unauthorized coin creation.
Bitcoin Core maintains a security classification system that distinguishes between different levels of risk.
The highest category, critical, is generally reserved for vulnerabilities that could threaten the network’s fundamental security properties.
Examples include flaws that could permit unauthorized creation of Bitcoin, compromise coins at the protocol level or cause permanent network-wide consensus failures.
The three newly disclosed issues did not reach that category.
Instead, they involved the operation and security of individual nodes.
For Bitcoin holders, the distinction matters.
A mining node temporarily failing to construct block templates does not mean the Bitcoin stored in users’ wallets becomes vulnerable to theft.
Likewise, a node experiencing delayed block processing does not automatically compromise the validity of the Bitcoin blockchain.
The Tor vulnerability could weaken certain protections on affected nodes, but it did not provide a mechanism for directly stealing cryptocurrency.
Developers also reported no evidence that attackers had exploited the three disclosed flaws.
Nevertheless, the issues were serious enough to warrant security fixes because reliable node operation is essential to Bitcoin’s decentralized infrastructure.
What Bitcoin Miners and Node Operators Should Do
The disclosures primarily affect individuals and organizations operating Bitcoin Core software.
For ordinary cryptocurrency investors who do not operate their own nodes, the vulnerabilities do not require direct action.
However, miners, infrastructure providers and independent node operators should ensure that their installations are properly maintained.
Recommended Security Measures
Update Bitcoin Core: Use a current, supported release containing the relevant security fixes.
Check installed versions: Operators running older releases should verify whether their software is affected.
Review Tor configurations: Examine optional whitelist settings and confirm that incoming Tor peers do not receive unintended permissions.
Monitor node performance: Investigate unexpected block-processing delays or repeated failures to construct valid mining templates.
Use official release sources: Obtain Bitcoin Core software and security information from trusted project channels.
Follow future security advisories: Monitor changes to the project’s disclosure policy and newly identified vulnerabilities.
For mining operations, reliable block-template creation is particularly important because interruptions can reduce the ability to compete for block rewards.
For independent node operators, timely updates help maintain network reliability and reduce exposure to denial-of-service attacks.
Security maintenance is therefore an important responsibility even when a vulnerability does not directly threaten user funds.
Bitcoin Security Disclosure Highlights Importance of Open-Source Development
The November 10 disclosures demonstrate both the complexity of Bitcoin’s infrastructure and the importance of coordinated security research.
Bitcoin Core is maintained through an open-source development process involving contributors, reviewers and independent security researchers.
This structure allows vulnerabilities to be investigated and corrected without relying on a single corporate software provider.
The three disclosed flaws affected different technical components, but all were addressed before their details became public.
The high-severity mining issue demonstrated how interactions between transaction policies and blockchain reorganizations could interrupt mining operations.
The block-processing vulnerability showed how malicious peers could exploit networking behavior to delay synchronization.
The Tor permissions flaw illustrated how configuration settings could unintentionally weaken protections for thousands of nodes.
Together, the incidents reinforce the importance of testing, peer review and regular software updates.
They also show why the Bitcoin development community is reassessing security procedures as artificial intelligence changes the vulnerability research landscape.
Bitcoin Core Patches Reinforce Network Security Without Evidence of Exploitation
The November 11 reporting on Bitcoin Core’s security disclosures highlights three important software vulnerabilities that could have affected mining operations, block processing and network privacy.
The most serious flaw, CVE-2025-62861, could prevent affected mining nodes from producing valid block templates following certain blockchain reorganizations.
Two additional vulnerabilities involved malicious compact-block announcements and incorrect trusted permissions for Tor connections.
All three issues were patched in October 2025, and developers reported no evidence that they had been exploited.
The vulnerabilities also did not permit direct Bitcoin theft, unauthorized coin creation or a permanent compromise of Bitcoin’s consensus rules.
For miners and node operators, the disclosures reinforce the importance of maintaining current software and reviewing network configurations.
For the broader cryptocurrency industry, they demonstrate how open-source security research and coordinated vulnerability disclosure contribute to the resilience of decentralized infrastructure.
The timing also underscores an emerging cybersecurity challenge: artificial intelligence is making software vulnerabilities easier to discover, prompting Bitcoin developers to accelerate security updates for weaknesses that attackers may be able to identify quickly.
Bitcoin Core’s latest security disclosures reveal that even mature blockchain infrastructure can contain serious operational vulnerabilities. However, the fact that developers identified and patched the issues before public disclosure—and reported no known exploitation—demonstrates the importance of continuous security research, software maintenance and responsible vulnerability reporting in protecting the world’s largest cryptocurrency network.
