Bitcoin Core Flaw Let Thousands of Nodes Trust Incoming Tor Peers

Thousands of reachable Bitcoin mainnet nodes treated incoming Tor connections as trusted peers, exempting them from denial-of-service limits and privacy protections. The cause is a medium-severity configuration flaw, CVE-2025-62860, that Bitcoin Core disclosed on Nov. 10.

Exposure required two conditions: a vulnerable release, and a non-default `-whitelist` setting that covered the IP address of the node's Tor daemon. Nodes that never enabled that setting were not affected. For incoming Tor connections, Core sees the Tor daemon's IP address rather than the remote peer's, so every such connection inherited the whitelist permissions and the exemptions that came with them.

The privileges described do not give an attacker wallet access or a means of stealing coins.

How so many nodes ended up exposed

Bitcoin Core says popular vendors bundled node software with Tor and a matching whitelist range, and some client software required whitelisting. The result was thousands of reachable mainnet nodes that whitelisted every incoming Tor connection. That figure describes historical exposure, not a count of nodes that remain vulnerable today.

Fix shipped more than a year ago

Martin Zumsande and Antoine Poinsot reported the issue in September 2025. The patch merged on Sept. 17 and stops applying address-based whitelist permissions to incoming onion connections. Fixes shipped in Bitcoin Core 30.0, 29.2 and 28.3 in October 2025, with 30.0 released on Oct. 10, 2025.

The 28.x and 29.x lines have since reached end of life. Maintenance now covers 30.x, 31.x and 32.x, and the download page lists 32.1 as the latest release as of Nov. 11. The project recommends running the latest maintenance release of the newest major version an operator can adopt.

Two other bugs in the same disclosure

The disclosure covered three flaws in total and followed the end of support for Bitcoin Core 29.x on Oct. 27, 2026:

• CVE-2025-62861 (High): affected block template creation during chain reorganizations involving TRUC transactions, in versions 28.0 to 28.2 and 29.0 to 29.1. Reported Sept. 26, 2025.
• CVE-2025-62860 (Medium): the Tor whitelist issue described above.
• CVE-2025-62859: a compact block processing flaw that let a malicious peer stall block processing for about 10 minutes. Reported April 2025.

Bitcoin Core reported no active exploits for any of the three.

What it means for operators

For most of the network, the practical impact is close to nil. Anyone on 30.0 or a patched October 2025 release has been covered for over a year. The residual risk sits with operators on unsupported software, such as miners still running 28.0 to 28.2 or 29.0 to 29.1, who remain exposed to the block template bug.

The details became public only after the last affected release line left support. For node operators, the disclosure is a prompt to check version numbers and to review any `-whitelist` ranges that include a local Tor daemon.