Privacy flaw in Bitcoin Core 31.0: feature can expose your IP
The new privatebroadcast feature in Bitcoin Core 31.0 can, under certain conditions, expose your real IP address. A fix is coming in version 31.1 — here is what you can do now.
Bitcoin Core has disclosed a privacy issue in version 31.0. The -privatebroadcast feature — intended precisely to hide your IP address when broadcasting a transaction — can, under certain conditions, expose that address to the receiving node instead. A fix has been announced for version 31.1.
How the flaw works
The problem affects only node users who have enabled -privatebroadcast and send transactions via the sendrawtransaction command. Normally such a broadcast runs encrypted via the BIP324 protocol and over Tor. But if that secured connection fails, Bitcoin Core may retry the connection via the older v1 protocol — without Tor. At that moment, the counterparty sees your real IP address.
Extra worrying: a malicious node can deliberately provoke that failure and thus bypass the privacy protection in a targeted way. The flaw was discovered by researcher Eugene Siegel.
Who is at risk — and who is not?
If you use an exchange or an ordinary wallet app, this flaw does not affect you: it only arises for those running their own Bitcoin Core node with this specific feature enabled. For that group, the exposure is moreover limited to linking a transaction to an IP address — no coins or keys are at risk.
This is what you can do now
Until version 31.1 is available, there are three options: temporarily disable -privatebroadcast, disable BIP324, or force all your outgoing connections to run over Tor. Anyone seeking maximum privacy chooses the latter.
The lesson is broader than this one flaw: even features built specifically for privacy deserve a healthy dose of distrust until they have proven themselves in practice.
Source: Bitcoin.fr, Bitcoin Core
Note: Investing in cryptocurrencies carries significant risks. You can lose your stake.