What happened
Developers have warned of a privacy vulnerability in the new private transaction broadcast feature.
Why it matters
The -privatebroadcast feature was implemented specifically to enhance user anonymity by hiding the transaction source from the network. A bug leading to the opposite effect—revealing the IP address—undermines trust in this privacy protection tool and creates de-anonymization risks for those who relied on this feature in version 31.0.
The Bitcoin Core development team reported a bug in software version 31.0 affecting the -privatebroadcast feature. Under certain network conditions, this vulnerability could cause the IP address of the node initiating a transaction to become known to the receiving peer. The issue manifests only when a node runs version 31.0 with the -privatebroadcast flag enabled and transaction broadcasting is performed via the sendrawtransaction RPC command.
A fix is being prepared and will be released in update version 31.1. Until the patch is available, users utilizing the private broadcast function are advised to apply one of the suggested workarounds to eliminate the risk of data leakage. Developers emphasize that the threat is relevant exclusively to configurations meeting all the listed conditions of simultaneous use of the specific version and sending methods.
This message constitutes an official warning from the protocol creators based on an internal code audit. Currently, the information is confirmed only by the primary source; independent technical reports or data regarding actual cases of exploitation by malicious actors are absent from the provided materials.
Confirmed facts
- A privacy bug was discovered in the -privatebroadcast feature in Bitcoin Core version 31.0.
- The vulnerability may reveal the sender's IP address to the receiving peer under certain network conditions.
- The issue occurs only if the node runs version 31.0, the -privatebroadcast flag is set, and the sendrawtransaction RPC command is used.
- A fix will be released in Bitcoin Core version 31.1.
- Users are recommended to use workarounds until update 31.1 is released.
Context
Bitcoin Core is the reference implementation of Bitcoin software. The private broadcast feature allows nodes to send transactions directly to a selected peer, bypassing standard propagation across the entire network, which theoretically complicates traffic analysis and linking transactions to specific IP addresses.
What remains unknown
- What are the technical details of the IP address leakage mechanism in this implementation?
- Have there been any recorded instances of third parties exploiting this vulnerability prior to the publication of the warning?
- How complex are the proposed workarounds for average node users?
AI analysis
Confidence: medium
The fact that the vulnerability was discovered and announced by the developers themselves before a mass incident indicates the presence of functioning internal security testing processes. However, the presence of a bug in a feature critical for privacy immediately after its implementation points to the complexity of realizing metadata hiding mechanisms in decentralized P2P networks.
Strategic AI conclusion
The most likely consequence will be a rapid update of a significant portion of security nodes immediately following the release of version 31.1. The next observable signal will be the statistics of node version updates in the Bitcoin network. The main uncertainty lies in what proportion of users managed to activate the new feature in the period between the release of 31.0 and the publication of the warning, and whether their data could have already been compromised.