Bitcoin Core has disclosed that it fixed 3 vulnerabilities that could slow or knock nodes offline. The bugs were first flagged by an AI-enabled security scan by Project Loupe last Friday, on the 23rd of October.
On the same day, the Bitcoin Core security team was notified of the same bugs. Earlier in the week, on 26th- 28th October, the team released new Bitcoin Core versions 29, 30, 31, and 32 with relevant fixes.
Nodes act as validators and enforce rules to ensure miners do not cheat the network. Bitcore Core is the software implementation of the said node and is widely used by exchanges, wallets, and other service providers to verify Bitcoin transfers are legitimate.
That said, one of the flagged bugs would allow a malicious actor to crash nodes running on Windows and macOS. The vulnerability would force service providers to manually restart their software/nodes. But Linux systems were not at risk.
The second bug would slow down systems by hoarding data in memory and forcing the service providers to run out of RAM. This would limit the node’s capacity to process new Bitcoin transactions.
Finally, the last issue was tied to corrupted data on older 32-bit computer systems. The bug could force the computer to shut down completely and was marked as ‘low severity.’ But the first two were categorized as ‘medium severity.’
In short, these bugs could be used to spam the Bitcoin node system and make it unstable (like denial-of-service, or DoS) attacks. However, the vulnerabilities couldn’t lead to stolen Bitcoin or private key compromise.
AI becomes a double-edged sword for Bitcoin
That said, the issues were disclosed on the 28th of October, way faster (about a week) than the typical one year. The long period for disclosure, especially for medium-severity issues, is designed to allow operators more time to upgrade their systems.
But as AI advances faster, the models can discover the bugs swiftly, meaning they can be exploited quickly too. Bitcoin Core has since changed the rules and will not keep most of the bugs secret for longer.
For easily discoverable vulnerabilities, we will publish a point release containing the fix for each maintained major version as soon as possible, along with a security advisory.
This underscores that AI can help prevent some of the security breaches. In fact, Ripple prevented a $90B unlimited XRP mint risk using AI.
At the same time, AI models have enabled the $100M Coldcard exploit and are largely responsible for high-value hacks and scams, according to Chainalysis.
Simply put, AI has become a double-edged sword that can cut both ways. The Bitcoin Core team has now launched automated testing to flag any bugs and harden underlying security. Whether the same urgency will be applied to quantum risks remains unclear.
Final Summary
- Bitcoin Core patched 3 issues that could allow an attacker to slow down and knock Bitcoin nodes offline.
- Bitcoin Core will now disclose bugs as soon as possible, unlike the 1-year waiting period citing AI risk.