Bitcoin Core Discloses 3 AI-Found Bugs That Crash Bitcoin (BTC) Nodes

Three Bugs, One New Policy

Bitcoin (BTC) Core has published the details of three vulnerabilities that an artificial intelligence scan uncovered in the node software, among them one that lets a remote machine crash a Bitcoin (BTC) node running on Windows, macOS or BSD. The write-ups went live on Wednesday, less than a week after the project adopted a new disclosure policy on Oct. 22 for bugs it judges easily discoverable now that large language models have cut the cost of finding them. The project's security advisories list all three, with the memory-exhaustion flaw described in full. That crash bug was flagged by the automated scan on Oct. 23 and confirmed by developers the same day. Fixes shipped on Oct. 27, and the advisory for the memory bug followed on Oct. 28 alongside two other findings the same scan had turned up. A node is the software that checks and relays every transaction across the Bitcoin network, and Bitcoin Core is the implementation most operators run, so a flaw in it is a network-wide matter. The Windows, macOS and BSD bug let any connected computer flood a node with data until it exhausted memory and went down. Until last week, Core developers kept medium-severity flaws of this kind confidential for as long as a year, giving operators time to upgrade before attackers learned where to look. That practice no longer applies to the easily discoverable class: fixes now ship as quickly as possible to every supported version, with a public advisory attached. All three bugs came out of one automated scan that used a large language model to comb through the codebase, and each finding was verified by a human contributor before it reached the security team. Nothing in the disclosed material touches Bitcoin price dynamics or the consensus rules; the exposure sits in resource handling on individual machines.

The second bug is the clearest argument for the policy change. The scan's finding reached the project on Sept. 15, and six days later a developer who had seen no report found the same flaw independently, a sequence that makes long secrecy look futile when a machine can rediscover a bug inside a week. The flaw let a connected peer claim to run an outdated version of the protocol and then stall, with messages piling up in the victim's memory at up to 2MB an hour for each incoming connection and 5MB an hour for each outgoing one, the advisory states. The third flaw, rated low severity, surfaced three separate times: in the scan, and in two independent reports from developers, in August and again on Oct. 23. A miner could craft blocks that overflow the files a node keeps for a reorganization, the process by which the network swaps a few recent blocks for a competing set under the proof of work rules that order the chain. On a 64-bit machine the attack would need roughly a month of the network's entire block production. On Windows and 32-bit systems the node can fail outright, and restarting does not clear the failure, the advisory says. Nodes on 32-bit hardware, or storing blocks on older FAT32 drives, remain exposed even after the fix. The release notes add that three more medium- and high-severity bugs, already fixed in Bitcoin (BTC) Core version 30.0, will be disclosed in two weeks. Operators on supported 64-bit builds clear the recorded exposures by upgrading to the patched releases; the constraints that leave any residue are hardware and storage, not code.

No Attacker Use On Record

COINOTAG's reading is that the policy shift re-prices secrecy: once an LLM can reach a bug, the project treats it as public regardless of who might have kept it private, and the advisory record now backs that stance with dates rather than intentions. The immediate risk concentrates on operators running 32-bit systems or FAT32 storage, since the patch does not cover them. Mining operations were never in scope; the flaws sit in node software, not in mining hardware or rewards. Nothing in the sources records a node crashed by an attacker in the wild, and no incident has been reported since the fixes shipped. That first confirmed report of a crashed node is the observation that would turn this patch notice into an incident; it has not been made.