Bitcoin Core has released version 31.1rc1, addressing a critical privacy flaw in the PrivateBroadcast feature that could expose users' IP addresses during transaction broadcasting. The vulnerability surfaces when private broadcast selects an IPv4 or IPv6 node that supports BIP324 v2 transport. If the v2 handshake fails, Bitcoin Core falls back to a v1 retry — but that reconnection bypasses the Tor proxy entirely, making a direct IPv4 or IPv6 connection to the peer. The affected scope is specific to nodes running Bitcoin Core 31.0 with -privatebroadcast enabled, broadcasting transactions via the sendrawtransaction RPC, and capable of establishing direct IPv4/IPv6 outbound connections. Before upgrading to version 31.1, Bitcoin Core advises relevant users to either disable -privatebroadcast, disable v2 transport, or route IPv4/IPv6 outbound traffic through Tor. Wallet RPC, onion, and I2P connections are not affected by this vulnerability.
The release introduces several improvements to blockchain validation and networking behavior. The software now manages transaction-related data more efficiently while maintaining a leaner blockchain database, designed to reduce unnecessary storage growth and improve performance as the chain expands. Networking behavior has been refined to handle proxy settings and PrivateBroadcast connections more intelligently, providing more predictable behavior for users routing traffic through privacy tools such as proxy networks. The enhanced Bitcoin validation process ensures more thorough management of transaction data, contributing to a more streamlined blockchain database that will help minimize future storage spurts and deliver better performance over time.
Wallet functionality received maintenance updates including improved migration checks and refined transaction input size estimation. These changes allow wallet operations to calculate transaction data more accurately behind the scenes without changing the user experience. The update also boosts support for MuSig2, a technology that merges several digital signatures into a single signature, with Bitcoin Core now rejecting empty public key lists containing invalid public keys to prevent incorrect signature aggregation. Security-related updates include additional safeguards for MuSig2, ensuring the software now rejects empty public key lists that include invalid public keys to avoid incorrect aggregation of signatures, improving overall security for users. The release candidate 31.1rc1 is already available for testing on the official Bitcoin Core website and includes fixes across validation, P2P networking, wallet migration, MuSig, build system, testing, and CI modules.
Several changes were introduced for developers maintaining or building software around Bitcoin Core. The release notes state that testing utilities have been cleaned up, race conditions have been removed, fuzz testing has been expanded, and build systems have been updated to improve software reliability during development. Configuration handling has been strengthened with Bitcoin Core now performing checks for failed write operations before saving important settings, designed to help prevent configuration errors caused by unsuccessful disk writes. These developer-friendly fixes ensure the software is more reliable for those building applications around Bitcoin Core.
Version 31.1rc1 is available for current versions of Linux, macOS, and Windows, with users running recent software versions able to upgrade directly. However, systems upgrading from much older releases may require additional time to migrate existing blockchain data. The developers are encouraging the community to install the software in test environments, verify its behavior under real-world conditions, and report any bugs before the stable release reaches the Bitcoin network. This release candidate (RC) allows users and developers to experience all its features in real time and report any unforeseen problems prior to its official release, with feedback collected during this testing phase helping identify remaining issues before finalization. The community is advised to test thoroughly before implementing the update to ensure proper privacy configurations are maintained.
