BITCOIN · SECURITY ·
Bitcoin Core discloses Tor whitelist flaw: which nodes were affected?
A newly disclosed, already patched configuration flaw could grant incoming Tor peers trusted permissions on some nodes. The advisory defines the narrow conditions.
Node operators: compare your installation with the exact affected versions and -whitelist condition. Readers: the flaw was already patched before disclosure.
What happened
Bitcoin Core published CVE-2025-62860 on 10 November 2026. With a non-default -whitelist IP range matching a local Tor daemon, incoming Tor peers could inherit permissions intended for trusted peers. This lifted some denial-of-service limits and privacy leak mitigations. The report describes a configuration-dependent node issue, not a break of Bitcoin consensus or the cryptography protecting balances.
Who was affected and what was fixed?
Nodes without the non-default -whitelist setting were never affected, according to the advisory. The issue was fixed in Bitcoin Core 28.3, 29.2 and 30.0 and later compatible versions. Operators should inspect their version and Tor/whitelist configuration using the original advisory rather than inferring exposure from a news headline.
Why the disclosure matters now
Security advisories often follow fixes so node operators have time to update. The practical lesson is operational: maintain patched software and review trusted-peer settings. The advisory does not establish a new wallet-draining exploit or a current price signal for BTC.
Original source
Bitcoin Core security advisory · 10 Nov 2026 ↗Source claims and forecasts are distinguished from independently verified outcomes. This article is not investment advice.