Bitcoin Core Reveals 3 Flaws: Blocked Miners and Thousands of Overconfident Nodes on Tor

Delayed confession. The developers of Bitcoin Core published three security advisories on Tuesday, November 10, on bugs fixed more than a year ago. One could block a miner from building blocks, another had any incoming Tor connection treated as a trusted friend. None allowed bitcoins to be stolen. Two weeks after the trio of flaws unearthed by an AI, this is the second batch of the fall, and it has nothing to do with the first.

Bitcoin Core and the flaw that left miners without a block to produce

The most serious of the three has the number CVE-2025-62861 and the level “high”. It affects versions 28.0 to 28.2 and 29.0 to 29.1 of the software. The culprit is the “sibling eviction” rule introduced with TRUC transactions (a category of transactions with stricter replacement rules designed for Lightning channels). During a chain reorganization, when a block is replaced by a competitor, its transactions return to the mempool, the node's waiting room. Bad surprise. The software could then leave child transactions there that spent missing outputs, and the node became incapable of producing a valid block pattern until restarted. A miner hit would have run idle without understanding why.

Bitcoin Core contributor Niklas Goegge reported the issue on September 26, 2025. The fix arrived in version 30.0 the following October 10, then in 29.2 and 28.3 afterwards. According to the advisory published on bitcoincore.org, no attacks exploiting this flaw have been observed.

Tor and compact blocks: two medium-level flaws

The second (CVE-2025-62860) concerns nodes that use the "-whitelist" option, a list of trusted IP addresses exempt from anti-spam limits and privacy protections. When the Tor proxy address fell within a declared range, all incoming Tor connections inherited the privilege. The notice speaks of "thousands of nodes reachable on the main network" which opened the door wide to any stranger passing through Tor. Martin Zumsande and Antoine Poinsot reported the bug on September 12, 2025, and Poinsot privately warned the affected software publishers a week later. Nodes that have never touched this option have not risked anything.

The third (CVE-2025-62859) dates back to April 2025 and a report by Eugene Siegel. A malicious peer who first announced a compact block could freeze the processing of its victim's blocks for ten minutes. The attack became infinitely repeatable if the attacker controlled the node's three “high-speed” peers, or if it was running in “-blocksonly” mode. Corrected in June 2025 on the main branch, the flaw only disappeared from stable versions with 29.2 and 30.0.