Bitcoin Core’s decision to stop sitting on bugs an AI could find has already put three of them out in the open, including one that lets a stranger crash nodes running on Windows and Mac computers.
The flaw, initially flagged by an AI scan on Oct. 23, let any computer connected to a bitcoin node running Windows, macOS or BSD flood that node with data until it ran out of memory and crashed. Developers confirmed it the day it was found, shipped fixes on Oct. 27 and published the details on Wednesday, along with two other bugs the scan had turned up.
A node is the software that checks and relays every bitcoin transaction, and Bitcoin Core is the program most nodes run. Until last week, Core developers kept medium-severity flaws like this one secret for as long as a year, to give operators time to upgrade before attackers learned where to look.
That changed on Oct. 22 for bugs the project judges “easily discoverable,” because LLMs have made those cheap to find. Their fixes now go out as soon as possible to every supported version, with a public advisory attached, as CoinDesk reported.
All three bugs came out of an automated scan which used a large language model to comb through Bitcoin Core’s code. Afterward, every finding was checked by a human contributor before it reached the project’s security team.
The second bug shows why Core changed its rules. The scan’s finding was reported to the project on Sept. 15, and six days later another developer found the same flaw independently. It let a connected node claim to run an outdated version of the protocol and then stall. Messages piled up in the victim’s memory at up to 2MB an hour for each incoming connection and 5MB an hour for each outgoing one, the advisory said.
The third bug, rated low severity, turned up three times: in the scan and in two separate reports from developers, in August and on Oct. 23. A miner could craft blocks that overflow the files a node keeps for a reorganization, which is when the network swaps out a few recent blocks for a competing set.
On 64-bit machines the attack would take roughly a month of the network’s entire block production. On Windows and 32-bit systems the node can fail outright, and “restarting does not help,” the advisory says. Nodes on 32-bit machines, or storing blocks on older FAT32 drives, stay exposed even after the fix.
Meanwhile, the release notes said three more medium- and high-severity bugs, fixed in version 30.0, will be disclosed in two weeks.