Bitcoin Core Confirms Privacy Bug in v31.0, Patch Arriving in Next Release

Bitcoin Core, the primary full-node software powering the Bitcoin network, disclosed a privacy vulnerability in its latest version 31.0 on Thursday. The bug, announced via the project’s official X account, could potentially expose the IP address of the user who first broadcasts a transaction to the node receiving it, under specific network conditions.

Details of the Vulnerability

The issue lies in how Bitcoin Core v31.0 handles transaction relay in certain peer-to-peer network scenarios. According to the development team, when a node running the affected version receives a new transaction, there is a small window where the originating IP address might be inadvertently leaked to the recipient node. This breaks the privacy assumptions many users rely on when running a full node.

The Bitcoin Core team has emphasized that the bug is not trivial to exploit and requires a specific set of network conditions to be triggered. However, for privacy-conscious users, particularly those running nodes in jurisdictions where Bitcoin usage is scrutinized, the risk is non-negligible.

Timeline and Fix

Bitcoin Core developers have already identified the root cause and are working on a patch. The fix is scheduled to be included in the upcoming v31.1 release, which is expected in the coming weeks. Users running v31.0 are advised to either downgrade to the previous stable version or wait for the patched release.

The disclosure follows standard responsible disclosure practices, with the vulnerability being reported internally before the public announcement. The project did not disclose who initially reported the bug.

Impact on Users and the Network

For the average Bitcoin user who relies on a third-party wallet or service, this bug has no direct impact. The risk primarily affects individuals and entities running their own Bitcoin Core full nodes, which are often used for enhanced privacy and security. An exposed IP address could potentially link a user to specific transactions, undermining the pseudonymity that Bitcoin offers.

This incident also highlights the ongoing challenges in maintaining privacy at the network protocol level. Bitcoin Core undergoes continuous auditing, but as the software evolves, new attack surfaces can emerge.

Conclusion

The discovery of this privacy bug is a reminder that even mature, well-audited software can have unforeseen vulnerabilities. Bitcoin Core’s transparent handling of the issue—prompt disclosure and a clear path to a fix—aligns with the project’s long-standing commitment to security. Users are encouraged to update to v31.1 as soon as it is released to restore full privacy guarantees.

FAQs

Q1: Is my Bitcoin wallet affected by this bug?
No. This bug only affects users running a Bitcoin Core full node with version 31.0. If you use a mobile wallet, exchange, or a third-party service, your IP address is not at risk from this specific vulnerability.

Q2: Should I stop using Bitcoin Core v31.0?
If privacy is a primary concern, consider downgrading to v28.0 or an earlier stable version until v31.1 is released. For most users, the risk is low, but the choice depends on your threat model.

Q3: How will I know when v31.1 is available?
Bitcoin Core will announce the release on its official website (bitcoincore.org) and its X account. You can also monitor the project’s GitHub repository for the release tag.