Bitcoin Core has officially confirmed the privacy vulnerability in its latest version v31.0, which could potentially expose users' IP addresses. The developers have now officially acknowledged the bug that was first disclosed on June 6, highlighting the urgency of the security issue. As per Bitcoin Core, this represents a real privacy flaw inside the -privatebroadcast feature, but it is not evidence that Bitcoin's broader privacy model is failing. The confirmation comes after initial reports from Bitcoin Core about the potential privacy exposure, with the key point being that a fix is forthcoming and will be released with 31.1, leaving a window of exposure for operators actively using the feature.
The privacy bug operates through a specific technical failure in the private broadcast system. When the software attempts an encrypted connection to another computer on the network and fails, it silently retries over a normal connection and skips Tor entirely. This bypass of the anonymity network allows recipients to see the sender's real IP address and approximate location, completely undermining the privacy protections. According to Bitcoin Core, when private broadcast connects to a peer that advertises v2 BIP324 transport, the first connection is routed through Tor as intended. If that v2 handshake fails, Bitcoin Core retries the connection as v1 without using the proxy, which can reveal the node's IP to the receiving peer. The vulnerability itself is narrow, occurring only when all of the following conditions are met: the node is running Bitcoin Core 31.0 with -privatebroadcast enabled, transactions are broadcast using sendrawtransaction RPC, Tor is reachable for outbound connections, and direct outbound IPv4 or IPv6 connections are allowed rather than blocked.
The vulnerability carries serious consequences for Bitcoin users due to the public nature of the blockchain. According to Bitcoin Core, linking a transaction to an IP address can tie payments to real people, creating significant privacy risks. The bug affects only users running version 31.0 who have enabled the private broadcast feature, with everyday wallet transactions remaining unaffected. For most everyday wallet users, the risk is negligible; the main concern is for privacy-sensitive operators actively using private broadcast. The exposure is narrow and only matters when all of the following conditions are met: users are running Bitcoin Core 31.0 with -privatebroadcast, broadcasting transactions with RPC, Tor is reachable for outbound connections, and direct outbound IPv4 or IPv6 connections are allowed rather than blocked. This also arrives during a period of heightened security attention, as Bitcoin Core recently published a use-after-free remote crash disclosure in the script interpreter, reinforcing the importance of staying on supported releases.
Developers have credited researcher Eugene Siegel with discovering the privacy bug, and a fix is now in development. As reported by Bitcoin Core, the patch will be included in version 31.1, though no specific release date has been provided. The team has a meta issue to track pull requests related to private broadcast, and recent coverage has highlighted both the progress and challenges of building meaningful privacy protections into Bitcoin Core. For users who rely on this feature, the fix window should be short, and development momentum is already there. Until the update arrives, affected users should disable the private broadcast feature or route all traffic through Tor to maintain privacy protections. Bitcoin Core notes that the leak depends on a failed v2 handshake followed by a direct v1 retry, meaning the issue is not just about ordinary network noise but also shows how a fallback path can become an attack surface if it does not fail securely.
Despite the privacy vulnerability disclosure, Bitcoin markets showed minimal reaction. According to Bitcoin Core, Bitcoin (BTC) trades near $63,700, little changed over the past day. The episode follows recent transaction relay disputes and raises questions about Bitcoin Core maintenance, adding to the challenges facing the project's privacy efforts. However, as noted by Bitcoin Core, this represents a real privacy flaw inside the -privatebroadcast feature, but it is not evidence that Bitcoin's broader privacy model is failing. The immediate signal is operational, not ideological: privacy features need secure fallbacks, and release notes alone are not enough if a failure path bypasses the intended protection. The main thing to watch is the 31.1 release and whether it fully closes the gap for -privatebroadcast users.
