Bitcoin Core disclosed three AI-discovered security vulnerabilities that could disrupt nodes, including one allowing attackers to remotely crash Windows and Mac systems.
The Oct. 28 disclosures identified two medium-severity memory-exhaustion vulnerabilities and a low-severity file-overflow flaw, exposing weaknesses in software used to validate transactions and maintain the Bitcoin network.
Developers released fixes in versions 29.5, 30.4, 31.2 and 32.1 after automated large language model (LLM) scanning discovered them. The findings highlight artificial intelligence's growing ability to identify security weaknesses in critical cryptocurrency infrastructure.
AI scanning exposes Bitcoin node vulnerabilities
The most immediately exploitable flaw allows a malicious peer to overwhelm Bitcoin nodes running on Windows, macOS, and BSD by sending specially crafted network data.
According to Bitcoin Core's advisory, the vulnerability bypasses safeguards designed to limit incoming data, allowing memory consumption to increase until the affected node crashes.
Linux systems are unaffected by this particular flaw because they use a different mechanism for monitoring network connections.
A second medium-severity vulnerability affects how Bitcoin Core communicates with older peers that do not support a network feature introduced under Bitcoin Improvement Proposal 31.
Malicious peers could exploit the mechanism to accumulate outgoing messages indefinitely, increasing memory consumption by up to 2 megabytes per hour per inbound connection and 5 megabytes per hour per outbound connection.
The resulting pressure could eventually exhaust a node's available memory, disrupting its ability to remain connected to the Bitcoin network.
The third vulnerability involves how Bitcoin Core handles files used to reverse transactions during blockchain reorganizations.
Under highly unusual circumstances, a miner could generate enough transaction data to overflow file-position limits, potentially corrupting records needed to process reorganizations and forcing affected nodes to shut down.
Bitcoin Core classified the issue as low severity because exploiting it on conventional 64-bit systems would require mining thousands of specially constructed blocks and engineering a precise blockchain reorganization.
All three vulnerabilities were initially identified through Project Loupe, an automated LLM-based security scanning initiative developed by Elias Rohrer at Spiral.
Gregory Sanders subsequently validated the findings and alerted Bitcoin Core's security team.
The earliest vulnerability was discovered July 8, followed by another on Sept. 15 and the Windows and macOS memory-exhaustion flaw on Oct. 23.
Developers completed the relevant patches on Oct. 26, released updated software over the next two days, and then publicly disclosed the vulnerabilities.
The accelerated response reflects Bitcoin Core's security policy, which calls for immediate disclosure once fixes become available for easily discoverable weaknesses, including those detectable through relatively simple AI-assisted scanning.
Previously, some vulnerabilities remained undisclosed for extended periods under severity-based disclosure schedules.
The advisories did not report active exploitation, but the technical details make upgrading especially important for operators still running vulnerable software.
However, the patches do not eliminate every exposure. Bitcoin Core warned that 32-bit systems and nodes storing blockchain data on FAT32 file systems remain susceptible to the file-overflow issue under specific conditions.
The 32.1 release notes also confirm that version 29.x and older branches have reached end of life, leaving operators on those releases without future security updates even if they install the 29.5 patch.
Operators moving to maintained versions must account for compatibility requirements, including macOS 14 or newer and Windows 10 version 1903 or newer for Bitcoin Core 32.1. Upgrades from obsolete releases may also require additional time for data-directory migration.
