Did you know Bitcoin nodes had a VIP list, and every Tor stranger got in uninvited?
On Nov 10, Bitcoin Core published three old bugs. The Tor one is rated Medium, needed a non-default setting, and was patched in Oct 2025. Here is what it really was.
> Bitcoin Core software runs on nodes, computers that check and relay Bitcoin transactions.
> Operators can set a "-whitelist" option, a guest list of trusted peers that get relaxed limits.
> Tor hides who is really connecting, so a node sees every Tor visitor as coming from its own local Tor service.
> If that address sat on the guest list, every stranger arriving over Tor got VIP treatment: looser limits against attacks and weaker privacy protections.
> Bitcoin Core says thousands of reachable nodes ended up like this, because popular node bundles shipped with Tor plus a matching whitelist.
Details many people may skip:
- It needed a non-default setting. Nodes without -whitelist were not affected.
- Fixes shipped in Oct 2025 (versions 30.0, 29.2, 28.3). Core publishes Medium and High bugs only after the last affected version stops getting support, plus two weeks. That is why you read it in Nov 2026.
- The coverage I read describes weaker node limits and privacy, not stolen coins. No active exploits were reported (per Crypto Briefing).
- Running your own node? Check your version and every whitelist= line in bitcoin.conf (per CryptoTicker).
Severity, versions, fix date. Check all three before you worry 😉
Experience, not financial advice.
$BTC #BitcoinCoreDisclosesTorTrafficVulnerability