The medium-severity vulnerability, identified as CVE-2025-62860, caused certain Bitcoin nodes to mistakenly classify external Tor connections as trusted. Bitcoin Core's whitelist configuration normally grants additional permissions to approved connections. However, Tor traffic appeared to originate from local software, allowing external users to inherit trusted privileges when local addresses were whitelisted.
Bitcoin Core noted that the flaw resulted in ‘thousands of reachable mainnet nodes whitelisting all incoming Tor connections.’ Researchers Martin Zumsande and Antoine Poinsot reported the issue in September 2025. Nodes without whitelist configurations were unaffected.
