Silicon eyes this time. Eric S. Raymond assured in 1997 that with enough eyes all bugs become superficial. A language model scrutinized the Bitcoin Core code and revealed three flaws, all of which were fixed and made public on October 28.
One allows you to crash a Windows or Mac node remotely. However, the project has long preferred silence on this type of matter: Bitcoin Core had waited two years to reveal a severe flaw. Here's what you need to know.
What flaws did AI find in Bitcoin Core?
Bitcoin Core is the software used by most nodes, the computers that verify and relay each network transaction. The three security advisories published Wednesday describe three separate bugs.
The most serious, classified as medium severity, affects Windows, macOS and BSD. A malicious peer connected to the node can force-feed it data until it saturates its memory. The developers talk about a node that can be “trivially crashed”.
The second, also of medium severity, causes memory to expand more slowly. Up to 2 MB per hour for each incoming connection, 5 MB for each outgoing connection.
The third is considered weak. It corrupts the undo files, those that the node keeps to undo the last blocks in the event of a chain reorganization.
It all starts with Project Loupe. This automated scan, led by Elias Rohrer at Spiral, entrusts the Bitcoin Core code to a language model. Each result then passes through the hands of a human developer, Gregory Sanders, before reaching the security team.
For the Windows and Mac flaw, the tool hit right on October 23. On Linux, Bitcoin Core monitors its connections with the poll() function. Elsewhere, it goes through select(), which continued to watch for "urgent data" from TCP, an old network protocol priority channel. It was enough to send some to get around the pause imposed on overly talkative peers.
The machine has also outstripped humans. Loupe spotted the second bug on September 15, six days before developer L0rinc. For third, she had a lead of six weeks over L0rinc and three and a half months over Andrew Dorman.
Is your Bitcoin node at risk?
It all depends on your machine. Nodes running Linux escape the main flaw, which only targets Windows, macOS and BSD.
The undo file bug is more vicious on certain systems. The code stored their position on 32 bits, so that a file larger than 4 GiB had its old data overwritten. On a 64-bit machine, a miner would have to spend around a month of the network's total output to mine it. The developers consider the scenario “impractical”.
Windows and 32-bit systems do not have this margin. The threshold drops to 2 GiB and the node shuts down on every reboot. FAT32 drives and 32-bit machines remain exposed even after the patch.
Which version of Bitcoin Core to install?
The fixes are available in four versions. 32.1 and 31.2 were released on October 27, 29.5 and 30.4 the next day.
Are you running a node on Mac or PC? Switch to the corrected version of your branch without delay, since the recipe for the attack is now public. If the undo file has already overflowed, the node will need to be rebuilt with the -reindex option.
Why is Bitcoin Core publishing these flaws so quickly?
Bitcoin Core has until now kept its medium-severity flaws under embargo for months, sometimes a year, while operators update. Its security policy now creates a separate category, “easily discoverable” flaws, identifiable “with minimal effort, for example via a simple request to an LLM”.
These leave immediately. The patch is published on all maintained versions, accompanied by a public notice. The reasoning makes sense, because if an AI finds the flaw in a request, an attacker will find it too.
Are your bitcoins at risk?
No. All three reviews describe node crashes and hangs, no theft of funds. Your BTC remains on the blockchain, regardless of the state of the software consulting it.
The risk primarily concerns those who run their own node. A crashed node no longer relays transactions or verifies anything until it restarts.
