An AI scan found a bug that lets a stranger crash a Bitcoin node on Windows or a Mac just by connecting to it. The fix is already out, so the real risk now is every node runner who puts off the update.
Key points:
- An AI scan flagged three bugs in Bitcoin Core, and the worst one lets a connected computer flood a Windows, Mac or BSD node until it runs out of memory and crashes.
- Fixes shipped on October 27 in versions 29.5, 30.4, 31.2 and 32.1, but a node that never updates stays open to the crash.
- Three more bugs fixed in version 30.0 get their public write-up in two weeks, so this round is far from over.
Bitcoin Core put the details out on October 28, days after an AI scan flagged the worst bug on October 23. Developers checked it the same day it was found and shipped fixes on October 27. My own read is simple: This is not a Bitcoin-is-broken story, it is an update-your-node story. A node is the software that checks and passes on every Bitcoin payment, and Bitcoin Core is the program most nodes run, so a crash bug in it hits the network's backbone, not just one wallet.
The policy behind the quick disclosure changed on October 22. Until then, Core held medium bugs back for up to a year, to give node runners time to update before attackers knew where to look. Now bugs judged easy to find go public fast, with a fix attached, because AI tools have made them cheap to spot. Every AI finding still went past a human checker before it reached the security team.
Read also: Ledger Tampered Wallets Cost Singapore Users $2.7M — Police Issue Warning
What should node runners do right now?
The second bug works more slowly. It was reported on September 15, and another developer found it on his own six days later. A connected node can claim it runs an old version of the protocol, then stall, and messages pile up in the victim's memory at up to 2MB an hour for each incoming link and 5MB an hour for each outgoing one. Linux nodes dodge the crash bug, but this slow pile-up is a separate worry.
The third bug is rated low, and it needs a miner to craft blocks that overflow the files a node keeps when the chain swaps a few recent blocks for a competing set. On 64-bit machines, that attack would take roughly a month of the whole network's block output. On Windows and 32-bit systems, the node can fail outright, and the advisory warns that restarting does not help. Nodes on 32-bit machines, or storing blocks on older FAT32 drives, stay at risk even after the fix.
So the next date to watch is in two weeks, when three more medium and high bugs fixed in version 30.0 get their public write-up. No coins were stolen here — a crashed node just stops checking and passing on payments until someone restarts it. The real test now is how fast node runners move to the patched versions, because the bugs are public and the fixes are already in hand.
Read also: Canada's First Bitcoin Mortgages Arrive in Early 2027 — What's the Catch?
— BitByLine News Desk
One quick word before you go: This is news to read, not money advice. BitByLine never tells you to buy or sell anything, and that call stays yours alone, along with the risk that comes with it. Always check the facts yourself first.
Read our full Disclaimer.
Sources: CoinDesk, KuCoin