TL;DR
Bitcoin Core published details of three vulnerabilities identified by an AI-assisted scan and checked by human contributors. One could let a remote computer exhaust memory and crash nodes on Windows, macOS and BSD; fixes were released on Oct. 27. The project also says three more flaws fixed in version 30.0 are due to be disclosed in two weeks.
Bitcoin Core published details on Oct. 29 of three vulnerabilities identified by an AI-assisted scan, including one that could let a remote computer exhaust memory and crash nodes running Windows, macOS or BSD. Developers said they verified the findings and released fixes on Oct. 27, making the disclosures an early test of the project’s newly changed policy for reporting bugs that are considered easy to find.
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The remote crash flaw was first flagged by the scan on Oct. 23, according to CoinDesk’s report. A computer connected to an affected node could send enough data to consume its available memory and cause it to stop running. Bitcoin Core developers confirmed the issue on the day it was found, then issued fixes four days later. The published advisory describes the affected systems as Windows, macOS and BSD.
A second flaw allowed a connected node to claim it was running an outdated protocol version and then stall. The advisory said messages could accumulate in memory at a rate of up to 2 megabytes per hour per incoming connection and 5 megabytes per hour per outgoing connection. The bug was reported on Sept. 15, and another developer independently found it six days later.
The third, low-severity issue involved crafted blocks that could overflow files used during a chain reorganization, when nodes replace recent blocks with a competing set. The advisory estimated that on 64-bit machines, exploiting it would require about a month of the network’s entire block production. It said Windows and 32-bit systems could fail outright. Nodes on 32-bit machines or older FAT32 drives remain exposed to this issue even after the fix, according to the advisory.
How the New Disclosure Rule Changes Response
The disclosures matter both for node operators and for how open-source cryptocurrency software handles security reports. A node checks and relays Bitcoin transactions, and Bitcoin Core is the software used by most nodes, according to the report. A crash or stalled node can interrupt that operator’s participation in the network, although the source material does not say that these flaws caused a broader Bitcoin network outage.
Bitcoin Core changed its approach on Oct. 22 for vulnerabilities the project considers “easily discoverable.” Developers had previously kept medium-severity flaws private for as long as a year to give operators time to update before attackers learned the details. Under the revised policy, fixes for these bugs are to be released as soon as possible across supported versions, alongside public advisories. Publishing details after a fix can help operators understand the risk, while also making prompt updates more important.
The scan’s findings were not accepted automatically: human contributors checked each finding before it reached the security team. The episode therefore shows an AI tool contributing to bug discovery, not independently validating or repairing Bitcoin Core software.
Products Worth Considering
Apple MacBook Pro 2026 14.2 Laptop with M5 Pro chip, 15‑core CPU, 16‑core GPU, 24 GB Unified Memory, 1 TB SSD, Wi‑Fi 7 – Silver
Apple MacBook Pro 16-inch (2021), M1 Pro, 10-core CPU, 16-core GPU, 16GB RAM, 512GB SSD, Silver
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 24GB Memory, 1TB SSD, Midnight
As an affiliate, we earn on qualifying purchases.
Why Bitcoin Core Changed Its Disclosure Timing
The project’s policy shift reflects a concern that large language models have made some vulnerabilities cheaper to identify. According to CoinDesk, the new rule covers bugs the project judges easy to discover and replaces the previous practice of withholding certain medium-severity disclosures for up to a year.
The three published bugs differed in how they were found and in their effects. The memory-exhaustion issue was flagged by the scan on Oct. 23. The protocol-stalling flaw had already been reported in September and was independently identified by another developer. The block-file issue appeared in the scan and in two developer reports, one in August and another on Oct. 23. These overlapping reports show that the AI scan was one route to findings, not the sole source of the project’s security reports.
““restarting does not help””
— Bitcoin Core security advisory, as quoted in CoinDesk’s report
Remaining Exposure and Unpublished Findings
The report does not specify how many nodes were affected, whether any of the vulnerabilities were exploited, or how many operators had installed the fixes by the time the advisories were published. It also does not provide a complete list of affected software versions in the supplied material, so operators should consult Bitcoin Core’s official advisories and release information for version-specific guidance.
The low-severity block-file issue has a stated exception: nodes using 32-bit machines or older FAT32 drives remain exposed after the fix, according to the advisory. The source does not say when or whether those cases will receive a separate remedy. It also does not identify the AI model or scan setup used to find the vulnerabilities.
Three additional medium- and high-severity flaws, already fixed in Bitcoin Core version 30.0, have not yet been described publicly. Their details are expected in two weeks, but the supplied report does not give their technical impact or affected configurations.
More Version 30.0 Advisories Expected
Bitcoin Core’s release notes say details of the three additional medium- and high-severity vulnerabilities fixed in version 30.0 are expected to be published in two weeks. Those advisories should clarify the bugs’ impact and which users or configurations may be affected.
For now, the immediate practical step for operators is to check Bitcoin Core’s official release and security information and confirm that their software is updated. Users on the 32-bit and FAT32 configurations named in the advisory should pay particular attention to official follow-up guidance, because the report says the block-file issue can remain a risk for those systems.
Key Questions
What did the AI-assisted scan find?
It identified three Bitcoin Core vulnerabilities, including a flaw that could let a remote computer exhaust memory and crash a node on Windows, macOS or BSD. Human contributors checked the findings before they reached the security team.
Have fixes been released?
Yes. The report says developers released fixes on Oct. 27, 2026, two days before publishing details of the three findings. Check Bitcoin Core’s official release information for version-specific instructions.
Does the report say the flaws were exploited?
No. The supplied report does not confirm that attackers used any of the vulnerabilities or say how many nodes were affected.
Are all affected systems protected by the fixes?
Not according to the advisory’s description of the block-file issue: nodes on 32-bit machines or older FAT32 drives remain exposed even after the fix. The report does not provide further remedy details for those configurations.
When will the next vulnerabilities be described?
Bitcoin Core’s release notes say details of three more medium- and high-severity bugs fixed in version 30.0 are expected in two weeks. Their technical details have not yet been disclosed in the source report.
Source: coindesk.com
