Bitcoin Core High-Severity Bug Could Have Stopped Miners Building Blocks

A mining node could keep hashing, keep its peers, keep syncing — and still be unable to build a single block. That was the quiet danger inside a high-severity Bitcoin Core bug disclosed on November 10, and the fix had already been sitting in released software for more than a year.

Key points:

• Bitcoin Core disclosed three patched flaws, led by CVE-2025-62861, a high-severity bug that could stop a mining node from building block templates after a chain reorganization.
• The bug hit Bitcoin Core versions 28.0 to 28.2 and 29.0 to 29.1. Fixes shipped in versions 30.0, 29.2 and 28.3 in October 2025, and no exploitation was reported.
• No coins were at risk, and the bug never reached Bitcoin Core's "critical" tier. Nodes still running the old versions stay exposed, because those release lines no longer get fixes.

Bitcoin Core, the reference software that runs most of the network's nodes, published three security advisories on November 10. The set covers denial-of-service and privacy flaws, not theft or forgery. The worst of the three, CVE-2025-62861, sits in block template creation, the step miners use to put new blocks together. During a chain reorganization, when the network drops one chain tip for a longer one, a transaction rule could fire at the wrong moment and throw out a transaction it should have kept. The mempool, the waiting room for unconfirmed transactions, was left in a broken state, and every block template the node tried to build after that failed its own validity check. The node looked alive. It just could not mine.

A restart cleared the state, since the mempool reloads from disk in a consistent shape. But the cause stayed in the code, so the next reorganization with the same transaction shape could stall the node again. Only an upgrade removed the bug for good. Security researcher Niklas Goegge reported the flaw on September 26, 2025. Developer Greg Sanders opened the fix three days later, and it was merged on October 2. Version 30.0 carried it on October 10, 2025, with 29.2 following on October 14 and 28.3 on October 17.

Read also: Solana Scraps Durable Nonces After $270M Drift Hack — Will Custodians Cope?

The disclosure waited 13 months on purpose

The gap between the fix and the public write-up was policy, not delay. Under Bitcoin Core's disclosure rules, medium- and high-severity flaws stay under embargo until two weeks after the last affected release line reaches end of life. The 29.x line reached that point on October 27, 2026, and the advisories landed exactly two weeks later. From the first fixed release to the detailed advisory, 396 days passed. The logic is plain: publish the details while old versions are still supported, and you hand attackers a map to unpatched nodes. Wait until the line is dead, and the only people still exposed are the ones who chose not to upgrade.

My own read is simple: a bug this quiet is worse than a loud one, because a miner would have blamed the hardware first.

No, Bitcoin was not hacked

The first wrong idea to kill is that Bitcoin was hacked. It was not. No coins could be stolen, no coins could be forged, and no chain split was on the table. Bitcoin Core keeps a four-tier scale, and none of the three flaws reached the "critical" tier it reserves for theft at the protocol level, fake coin creation, or permanent network-wide splits. The worst flaw needed a specific reorganization shape to bite, and the developers reported no sign that anyone ever used it. One honest caveat belongs here: "no exploitation reported" is the project's own word, not an outside audit. Nobody can prove a negative from the outside, so treat it as a strong signal, not a settled fact.

The other two flaws were smaller, but both real. CVE-2025-62859 let a hostile peer stall a node's block processing by announcing a compact block with a tampered witness, a form of transaction malleation. A single stall could hold up block processing for up to 10 minutes at a time. It was reported in April 2025 by Eugene Siegel. CVE-2025-62860 handed trusted-peer permissions to inbound connections over Tor, the anonymity network, lifting a set of denial-of-service and privacy protections on affected nodes.

AI changed the disclosure rules

The disclosure also shows how fast the ground is shifting. Bitcoin Core recently rewrote its security policy for AI, adding a category for "easily discoverable" flaws, ones a simple prompt to a language model can surface. Those get patched and disclosed at once, with no long embargo. The worry is that large language models have lowered the bar for finding bugs, and a volunteer crew called the Bitcoin Red Team has been racing to find AI-discoverable flaws across the ecosystem before attackers do. The advisories page already lists further 2026 disclosures, including memory-growth and undo-file issues, which tells you the pipeline is now moving faster than the old yearly rhythm.

The market barely blinked. Bitcoin traded near $74,352 on Wednesday, up about 1.2% over 24 hours, with Ethereum near $2,076, up about 1.6%. Traders read the news the way the facts point: a fixed historical flaw, disclosed on schedule, with no live threat and no coins at risk. The price action says the same thing. The risk was never a crash. It was a slow leak of mining time on machines nobody was watching.

What to check before the next advisory lands

If you run a node, check the version first. Anything on 30.0 or newer was never exposed to the published details. Anything still on 28.x, or on 29.0 or 29.1, is running code with the bug in it, and those lines no longer receive fixes. Write down three numbers before your next upgrade: your current version, the date you last restarted the node, and how long your last block-template failure, if any, took to clear. Those three numbers turn the next advisory from a scare story into a five-minute check. Then watch two things: the next batch of Bitcoin Core advisories, and whether old-version nodes keep shrinking as a share of the network. The fix for this bug was ready a year ago. The only question left is who is still running the old code.

Read also: What Is Proof of Work in Crypto? How Mining Secures Bitcoin

— Muhammad Irfan

About the author: Muhammad Irfan is the founder and editor of BitByLine. He writes crypto news and beginner guides in simple, everyday language, so readers without a finance background can follow along. Read more about the editor.

This post is news only, not financial advice. Always do your own research before buying or selling crypto. Read our full Disclaimer.

Sources: Decrypt, Coindoo, CoinGecko, Bitcoin Core security advisories.