AI Found 3 Bugs That Can Crash Bitcoin Nodes on Windows and Mac: Check Your Version Now

An AI Scanner Found a Way to Crash Bitcoin Nodes — and the Fix Is Already Out

An automated AI security scanner found three flaws in Bitcoin Core that let a stranger crash nodes running on Windows, macOS, or BSD — and Bitcoin's developers changed a years-old secrecy rule to tell the world immediately. The patches are already out in versions 32.1, 31.2, 30.4, and 29.5. If you run a node on one of the affected systems and have not updated since October 27, 2026, you are running the vulnerable code right now. No coins were stolen and no consensus rules were broken — but an unpatched node can be knocked offline by any peer it connects to, and that is exactly the kind of quiet availability failure that stalls wallets, exchanges, and payment services.

This is also a story about how Bitcoin defends itself in the AI era. The flaws were found not by a human auditor, but by Project Loupe, an automated large-language-model scanner built by Elias Rohrer at Spiral. Every finding was then checked by a human contributor before it reached Bitcoin Core's security team. And because AI tools can now find these bugs cheaply, the project decided attackers can rediscover them cheaply too — so it stopped sitting on them. On October 22, 2026, Bitcoin Core changed its disclosure policy: bugs judged "easily discoverable" are now fixed and published at once, instead of being kept secret for up to a year while operators quietly upgraded. The three bugs disclosed on October 28 are the first test of that new rule.

What Happened: Three Bugs, Found by AI, Fixed in Days

Bitcoin Core is the reference software that runs most of the Bitcoin network's full nodes — the computers that verify every transaction and block. On October 27–28, 2026, its developers released security updates across four maintained branches after Project Loupe's automated scan identified three vulnerabilities. Two were rated medium severity and one low, according to the project's official advisories. All three were validated by human contributors — Gregory Sanders checked the reports and brought them to the security team — before any fix shipped.

The timeline shows how fast the new policy moves. The most dangerous flaw, tracked as CVE-2026-117350, was flagged by the AI scan on October 23, confirmed by developers the same day, patched on October 27, and publicly disclosed on October 28. Under the old policy, a medium-severity flaw like this one could have stayed secret for up to a year. The second flaw had already been reported to the project on September 15, 2026, and was independently rediscovered by another developer six days later — proof, in the project's own reasoning, that "easily discoverable" bugs do not stay hidden for long once AI scanners exist.

There was no reported active exploitation in any of the disclosures. That should not be mistaken for a reason to wait: once a fix and an advisory are public, anyone can work out where the old code is weak. The window between disclosure and patching is now the risk window, and it is measured in days, not months.

The Three Flaws, Explained in Plain English

None of these bugs lets an attacker steal bitcoin, forge transactions, or rewrite the blockchain. They are availability and data-handling flaws — they attack a node's ability to keep running, not Bitcoin's rules. But for anyone whose business depends on a node, a crashed node means stopped payments, stalled confirmations, and manual recovery work. Here is what each one does.

1. The TCP Urgent-Data Crash (CVE-2026-117350, Medium)

A malicious peer connected to your node could send a special kind of network traffic — TCP urgent data — that bypassed Bitcoin Core's normal backpressure limit, the mechanism that stops a peer from flooding the node with more data than it can process. With that limit bypassed, memory kept growing until the node ran out and crashed. This flaw affected nodes running on Windows, macOS, and BSD. Linux nodes were not affected by this particular bug because they use a different socket-monitoring path. Fixes shipped in versions 29.5, 30.4, 31.2, and 32.1.

2. The Stalled Old-Protocol Peer (CVE-2026-117349, Medium)

The second bug involved peers claiming to use an outdated version of the Bitcoin protocol — one that predates the ping messages introduced under Bitcoin Improvement Proposal 31 (BIP 31). By claiming the old protocol and then stalling, a malicious peer avoided the timeout mechanism that would normally disconnect an unresponsive connection, while delaying its reads of data. Network announcements then piled up in the victim node's memory. Developers estimated the growth at up to 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer. Those are upper estimates for vulnerable connections, not measurements of overall network memory use — but left running for days, they add up to a crash.

3. The Undo-File Overflow (CVE-2026-117346, Low)

The third flaw concerned the undo files Bitcoin Core keeps so it can reverse recent blocks during a blockchain reorganization — the moments when the network swaps out a few recent blocks for a competing chain. A miner could craft blocks that push those files beyond their permitted size limits, corrupting data or shutting down affected nodes. On modern 64-bit systems the attack would require roughly a month of the network's entire block production, which is why it was rated low severity and exploitation was called impractical. But the fix only fully covers 64-bit systems: 32-bit systems and nodes storing blocks on older FAT32 drives remain affected, and for nodes whose undo data is already corrupted, the advisory warns plainly that restarting does not help.

The Three Bugs at a Glance

Flaw	What an attacker does	Who is affected	Severity	Fixed in
CVE-2026-117350 — TCP urgent data	Floods a connected node past its backpressure limit until memory exhausts and it crashes	Windows, macOS, BSD nodes (Linux unaffected)	Medium	29.5, 30.4, 31.2, 32.1
CVE-2026-117349 — Stalled old-protocol peer	Claims an outdated protocol, stalls, and forces announcements to pile up in memory	Nodes connected to malicious peers (up to 2 MB/hr inbound, 5 MB/hr outbound)	Medium	29.5, 30.4, 31.2, 32.1
CVE-2026-117346 — Undo-file overflow	Crafts blocks that overflow reorganization undo files	32-bit systems and FAT32 storage remain exposed even after patching	Low	29.5, 30.4, 31.2, 32.1

One version note matters for upgraders: Bitcoin Core 32.0 was tagged but never fully released because of last-minute issues, so 32.1 is the published version on that branch. And version 29.x has reached end of life despite receiving this final patch — operators still on 29.x should treat this update as their exit ramp to a supported branch, not as a reason to stay.

Why Bitcoin Core Changed Its Secrecy Rule

Until October 22, 2026, Bitcoin Core's practice was to keep medium-severity flaws secret for as long as a year, giving operators time to upgrade before attackers learned where to look. That made sense when finding a bug required a skilled human auditor and months of work. It makes less sense when a large language model can comb through the codebase and surface the same flaw in an afternoon — and when, as the second bug proved, two independent parties can find the same flaw within a week of each other.

The new policy draws a line at "easily discoverable": if an AI scanner can find it cheaply, an attacker can too, so the fix and the advisory go out together, across every supported branch at once. The trade-off is real — public advisories hand attackers a map — but the project judged that the old embargo now protects attackers more than operators, because the bugs are discoverable with or without the advisory. Expect this to become the pattern: AI-found flaws disclosed fast, with short upgrade windows, several times a year.

There is more coming. The release notes say three additional medium- and high-severity vulnerabilities fixed in Bitcoin Core version 30.0 are expected to be disclosed in about two weeks under the project's normal schedule. Node operators should treat this disclosure as the first of a pair, not a one-off, and keep their upgrade process warm.

What This Means for Bitcoin's Price and the Network

For ordinary holders, the direct answer is reassuring: this is not a "Bitcoin is broken" event. No coins were stolen, no keys leaked, and the network's consensus rules were never in question. Bitcoin traded near $77,900 in the days around the disclosure, moving mainly on the aftermath of the $6.3 billion Binance hack and ETF outflows, not on these bugs. The market treated the disclosure as a routine — if unusually transparent — software patch.

The deeper signal is about infrastructure maturity. Bitcoin's security model has always depended on thousands of independent nodes verifying the same rules. A bug that can knock nodes offline does not break those rules, but it does thin the network's redundancy if enough operators ignore the patch. The good news is that the fix is a routine upgrade, the patched versions cover every supported branch, and the disclosure itself — fast, detailed, and honest about what remains unfixable on 32-bit and FAT32 systems — is the kind of transparency that builds long-term trust in the network. Compare that with the exchange world, where users only learn about a breach after the money is gone: here, the flaw was found by a scanner, fixed in days, and published with exact version numbers.

For traders, the practical takeaway is timing, not panic. Node outages do not move the bitcoin price directly, but they can delay exchange deposits, wallet syncing, and merchant confirmations during the exact hours when volatility is highest. If you run a service that depends on a node, the cost of this patch is an hour of maintenance; the cost of skipping it is an unexplained outage during the next market swing.

Node Operator Checklist: Are You Safe?

Work through this list in order. It takes most operators under an hour, and it closes all three flaws except the known 32-bit and FAT32 exceptions.

• Check your running version — open Bitcoin Core and read the version number, or run bitcoind --version on the command line. If you are on 29.x, 30.x, 31.x, or 32.x, compare it against the patched releases: 29.5, 30.4, 31.2, and 32.1.
• Upgrade to a patched release — download the new version only from the official Bitcoin Core site, verify the release signatures, and install it on every node you run, including testnet and backup nodes.
• Confirm your operating system exposure — if you run Windows, macOS, or BSD, the TCP urgent-data flaw (CVE-2026-117350) applies to you directly. Linux operators should still patch, because the stalled-peer and undo-file flaws are not OS-specific.
• Check your storage and architecture — if any node runs on a 32-bit system or stores blocks on a FAT32 drive, understand that the undo-file flaw remains even after patching. Plan a migration to 64-bit hardware and a modern filesystem.
• Verify undo data health — if a node has crashed or behaved strangely around reorganizations, do not assume a restart fixes it. Corrupted undo data cannot be recovered by restarting alone; reindex or restore from a clean backup.
• Watch for the next disclosure — three more medium- and high-severity issues fixed in version 30.0 are due to be published in about two weeks. Keep your upgrade process ready rather than treating this patch as the end of the story.
• Move off end-of-life branches — version 29.x received this patch as its final update. Schedule a move to a supported branch now, before the next disclosure leaves 29.x behind.
• Restart and monitor — after upgrading, confirm the node syncs, peers connect normally, and memory usage stays flat over several hours. A node whose memory climbs steadily after patching deserves a second look.

What Most People Get Wrong About This Story

The headlines write themselves — "AI hacks Bitcoin" — and they are wrong in three specific ways. First, no AI hacked anything: an AI scanner found bugs in source code, humans validated every finding, and humans wrote the fixes. Second, the bugs crash nodes; they do not steal coins, and conflating the two is how panic spreads. Third, the fast public disclosure is not a sign that Bitcoin is suddenly fragile — it is a sign that its disclosure policy finally caught up with a world where AI scanners exist. A project that publishes its flaws quickly, with CVE numbers and exact fixed versions, is easier to trust than one that sits on them for a year. The real risk was never the disclosure. It is the operator who reads about it and decides to upgrade "later."

Frequently Asked Questions

Can these bugs steal my bitcoin?

No. All three are availability and data-handling flaws: they can crash a node or corrupt its local data. They do not let an attacker move coins, forge transactions, or break Bitcoin's consensus rules, and no exploitation was reported.

Which Bitcoin Core versions are safe?

Versions 29.5, 30.4, 31.2, and 32.1 contain the fixes. Anything earlier on those branches is vulnerable. Note that 32.0 was never fully released, so 32.1 is the version to install on the newest branch.

I run Bitcoin Core on Linux. Do I need to update?

Yes. Linux nodes escape the TCP urgent-data flaw specifically, but the stalled-peer memory bug and the undo-file flaw still apply. Update to the patched release on your branch regardless of operating system.

What if I run a node on a 32-bit system or a FAT32 drive?

The undo-file flaw remains even after patching on those setups, and corrupted undo data cannot be fixed by restarting. Plan a move to 64-bit hardware and a modern filesystem, and restore from a clean backup if corruption is suspected.

Why did Bitcoin Core suddenly publish bugs it used to keep secret?

Because AI scanners changed the math. Under the policy adopted on October 22, 2026, bugs judged "easily discoverable" are fixed and disclosed immediately across all supported branches, since attackers with the same AI tools could rediscover them anyway.

Are more disclosures coming?

Yes — three additional medium- and high-severity vulnerabilities fixed in Bitcoin Core 30.0 are expected to be disclosed in about two weeks. Keep your node updated and your upgrade process ready.

Conclusion

An AI scanner found three ways to crash Bitcoin nodes, humans verified them, and the fixes shipped within days — followed by a public disclosure that would have been unthinkable under Bitcoin Core's old secrecy rule. That sequence is the story: not a crisis, but a security process adapting to the AI era in real time. For node operators the action is simple and urgent — upgrade to 29.5, 30.4, 31.2, or 32.1, check whether you sit on a 32-bit or FAT32 setup that stays exposed, and stay ready for the next disclosure in about two weeks. For everyone else, the lesson is quieter and more reassuring: Bitcoin's defenses are not just its cryptography, but thousands of independently run nodes, a scanner that never sleeps, and a project willing to publish its own flaws rather than hide them. If you run a node, patch it today — and if you want the full background on how Bitcoin Core thinks about security, start with our guide to whether Bitcoin is safe in 2026, then read how the network's economics work in how long it takes to mine one bitcoin and the 2028 halving countdown. The network stays secure because its operators stay current — make sure you are one of them. Sources: CoinDesk, ProCoinNews, BitcoinVersus, HokaNews.