Everything collected from official sources.
141 publications
Utreexo's accumulator takes less than 1 kB where a node otherwise keeps a UTXO set of roughly 11 GB, Davidson Souza explains on the #423 recap, at the cost of more bandwidth. Eric Price of MARA and PortlandHODL are also guests, with vardiff controllers that strand slowing miners and a draft BIP for unspendable internal keys on the list.
Bitcoin Optech
Mining pools can strand a slowing miner on a share difficulty set for its old speed, Eric Price argues on Delving Bitcoin; his remedy is a timer that lowers difficulty after an interval with no shares. Davidson Souza wants the SwiftSync hintsfile to remove Utreexo deletion proofs during initial block download, and NTL has drafted a BIP for unspendable taproot internal keys.
Bitcoin Optech
Adam Gibson walks Optech hosts Mark Erhardt and Mike Schmidt through Babilonia, his coinjoin protocol disguised as covert bets, and points to a 1997 Ron Rivest paper on lottery-style micropayments as an older root of probabilistic payments. Rob Segers then discusses his silent payments light client measurements.
Bitcoin Optech
Babilonia, a proposal from Adam Gibson, dresses coinjoins up as onchain coin flips that look like normal payments from outside, though his paper admits the protocol's efficacy has no clear measure yet. Rob Segers' benchmarks put BlindBit Oracle v2 at about 2.1x the download of a taproot-only filter plus tweak data, in exchange for no false positives. LDK v0.2.6 patches a denial-of-service vulnerability.
Bitcoin Optech
Heavy disk reads and writes during normal operation trace to a bug fixed in Bitcoin Core 29.4: the chainstate database kept rewriting large parts of itself. The fix disables LevelDB seek compaction and compacts the chainstate on a regular basis (#35465).
Bitcoin Core
Chainstate disk churn ends in Bitcoin Core 30.3, which also repairs a feebumper crash when the combined bump fee is unavailable (#34870) and a coin selection bug that computed an amount as a boolean (#34888). On the PSBT side, MuSig2 pubkeys now get validated during pubnonce and partial signature deserialization (#34219).
Bitcoin Core
An IP address leak in -privatebroadcast is closed in Bitcoin Core 31.1: some connections went out over clearnet instead of the enabled privacy network. The update also ends the chainstate rewrites behind excessive disk activity and rejects an empty pubkey list in MuSig2 key aggregation (#35316).
Bitcoin Core
A failed v2 handshake can expose the sender's IP address in Bitcoin Core 31.0: with -privatebroadcast set, the v1 retry skips the Tor proxy and connects directly to the peer. A malicious peer closing the handshake on purpose is the likely trigger. Until 31.1 ships, users can turn the feature off, set -v2transport=0 or send IPv4/IPv6 outbound through Tor.
Bitcoin Core
Bitcoin Core releases after 0.14.0 and before 29.0 could read freed memory while validating a crafted invalid block, crashing the node. CVE-2024-52911 is rated High, though an attacker must spend valid proof-of-work at the tip, and remote code execution is considered unlikely. Cory Fields reported it; 29.0 carries the fix.
Bitcoin Core
Cluster mempool replaces the old design in Bitcoin Core 31.0: ancestor and descendant limits give way to clusters capped at 64 transactions and 101 kB, and the CPFP carveout is gone. Default -dbcache rises to 1024 MiB on machines with at least 4096 MiB of RAM, and a new -privatebroadcast option sends sendrawtransaction broadcasts only over Tor or I2P.
Bitcoin Core
Two failures involving unnamed wallets get fixes in Bitcoin Core 28.4: legacy wallet migration (#34156) and createfromdump, whose failure path deleted the wallets directory (#34215). One DNS seed is also dropped from chainparams (#33723).
Bitcoin Core
Bitcoin Core 29.3 stops punishing peers that send consensus-invalid transactions (#33050). Validation gains a per-input sighash midstate cache for legacy, P2SH and segwit v0 scripts (#32473) and spots witness stripping without re-running Script checks (#33105), while the miner's addPackageTxs loses an unsigned integer overflow (#33475).
Bitcoin Core
A migration failure on unnamed legacy wallets is gone with Bitcoin Core 30.2 (#34156), and createfromdump no longer deletes the wallets directory when it fails on one (#34215). Pressing Ctrl-C no longer hangs during IPC wait calls (#33511).
Bitcoin Core
Under rare conditions a failed wallet.dat migration in Bitcoin Core 30.0 or 30.1 can delete every file in the wallet directory, putting funds at risk. Developers pulled those binaries and ask users not to migrate through the GUI or RPC until 30.2. The bug needs a default, unnamed wallet.dat that fails to migrate or load; other users are unaffected.
Bitcoin Core
Wallets on Bitcoin Core 30.1 stop considering unconfirmed TRUC coins that have ancestors (#33528). On the IPC side, options no longer require the -m argument (#33229), message logging costs less overhead (#33517) and running waitNext calls can be cancelled (#33676).
Bitcoin Core
Faked self-connections let an attacker pad a Bitcoin Core node's log files by reusing the version message nonce across many connections. The victim's first connection times out after 60 seconds by default, so filling a disk would take a long time; CVE-2025-54604 is rated Low. Niklas Goegge reported it in 2022, and log rate-limiting in 29.1 and 30.0 stops it.
Bitcoin Core
Repeatedly sending invalid blocks could run a Bitcoin Core node out of disk, since it logged every block failing basic sanity checks or forking off before the last checkpoint. Niklas Goegge and, independently, Eugene Siegel reported CVE-2025-54605, rated Low. Log rate-limiting in 29.1 and 30.0 fixed it.
Bitcoin Core
Crafted non-standard transactions could tie up a Bitcoin Core node for a few seconds each without getting the sender disconnected, giving an attacker a way to delay block propagation. CVE-2025-46598, rated Low, was reported by Antoine Poinsot and mitigated in v30.0 by cutting worst-case validation time.
Bitcoin Core
Blocks over 1GB could overflow a size check on 32-bit Bitcoin Core nodes and crash them on the write to disk, but only as a compact block, and only against a victim running -maxmempool above 3GB with 1GB of transactions inside. Pieter Wuille found CVE-2025-46597, rated Low; capping -maxmempool on 32-bit systems closed it in 29.1 and 30.0.
Bitcoin Core
Default minimum feerates drop in Bitcoin Core 28.3: -blockmintxfee to 1 satoshi per kvB, -minrelaytxfee and -incrementalrelayfee to 100 satoshis per kvB. Wallet feerates stay put, and cheaper transactions may not propagate unless the new defaults spread across the network. Whitelist permissions also stop applying to onion inbound connections (#33395).
Bitcoin Core
