AI scan uncovers Bitcoin node crash vulnerability; Windows and Mac nodes can be remotely taken down, officially disclosed

Author: Shaurya Malwa

Compiled by: TechFlow

TechFlow Editor's Note:Bitcoin Core is no longer sitting on vulnerabilities that large models can easily find—an AI scan uncovered three publicly disclosed flaws within one week, one of which lets strangers exhaust memory and crash nodes on Windows and Mac. For node operators, LLMs have changed the upgrade cadence: medium-severity flaws could previously remain undisclosed for a year, but now 'easy to find' bugs must be patched across all supported versions and disclosed as soon as possible.

Bitcoin Core decided to stop withholding vulnerabilities that AI can also find, and has already made three of them public; one can let strangers crash nodes running on Windows and Mac computers.

The flaw was first flagged by an AI scan on October 23: any computer connected to a Bitcoin node running Windows, macOS, or BSD could flood the node with data until it ran out of memory and crashed. Developers confirmed the issue the same day, released a fix on October 27, and disclosed details on Wednesday together with two other vulnerabilities found by the scan.

Nodes are software that validate and relay every Bitcoin transaction, and Bitcoin Core is the program most nodes run. Until last week, Core developers would keep this type of medium-severity vulnerability confidential for up to a year, giving operators time to upgrade before attackers learned where to strike.

Starting October 22, the rules changed for vulnerabilities the project deemed 'easy to discover,' because large language models have made such bugs cheap to find. Relevant fixes will now be pushed to every still-supported version as soon as possible, with a public security advisory, as CoinDesk reported earlier.

All three vulnerabilities came from an automated scan that used large language models to review Bitcoin Core code. Each finding was first checked by human contributors before being submitted to the project security team.

The second vulnerability explains why Core changed the rules. The scan result was reported to the project on September 15, and six days later another developer independently found the same flaw: it allowed a connected node to claim it was running an outdated protocol version and then stall. According to the advisory, messages accumulating in a victim node's memory could reach up to 2MB per hour per inbound connection and up to 5MB per hour per outbound connection.

The third vulnerability was rated low severity and was reported three times: once in the scan, and twice in developer reports in August and on October 23, respectively. Miners could craft blocks that cause a node's files prepared for a 'reorg' to overflow—a reorg is the process in which the network replaces recent blocks with a competing set of blocks.

On 64-bit machines, such an attack would consume roughly one month of network-wide block production. On Windows and 32-bit systems, nodes may become unusable, and the advisory states that 'restarting will not help.' Nodes running on 32-bit machines, or storing blocks on older FAT32 disks, may remain exposed even after being patched.

Meanwhile, release notes said three additional medium- and high-severity vulnerabilities fixed in version 30.0 will be disclosed in two weeks.

Source: TechFlow