An automated code scan built on large language models uncovered three security bugs in Bitcoin Core, the software that runs most of the network's full nodes, and the project shipped patches before disclosing the flaws publicly on October 29, 2026. The most serious of the three lets a connected peer crash a node by exhausting its memory. None of the bugs touch consensus rules or put coins at direct risk, and Bitcoin held near $81,623 as of October 29, up 1.4% on the day, according to CoinMarketCap data. The disclosure surfaced through a CoinMarketCap post and was detailed by CoinDesk.
A remote peer can starve a node of memory
The headline flaw, rated medium severity, affects Bitcoin Core nodes running on Windows, macOS, and BSD. A single connected machine can flood the target with data until the node runs out of memory and crashes. There is no theft and no fund exposure. The payoff for an attacker is disruption: a node that falls over stops validating and relaying transactions until someone restarts it.
For an individual running a node at home, that is an annoyance. For businesses, exchanges, or payment processors that depend on their own infrastructure to confirm transactions, repeated crashes become an availability problem rather than a security one.
Two slower-burning flaws rounded out the batch
The second bug, also medium severity, lets a connected node claim an outdated protocol version and stall normal operation. Messages pile up in the victim's memory at up to 2MB per hour for each incoming connection, a slow leak rather than an instant crash. The third, rated low, is an overflow in the files Bitcoin Core writes during a chain reorganization. It can crash 32-bit systems and older FAT32 storage, and in that case restarting does not clear the problem.
All three now have fixes merged across the supported release branches, with version 32.1 among the releases carrying the patch. The practical takeaway for anyone running the software is short: update.
An LLM scan rewrote Bitcoin Core's disclosure math
The bugs were surfaced by automated language-model scans, then validated by human contributors before the security team reviewed them. One scanning effort, Project Loupe, flagged the memory-exhaustion bug on October 23. That timeline matters because of what the project did a week earlier.
On October 22, Bitcoin Core changed how it handles a class of vulnerabilities it calls easily discoverable. Historically, maintainers kept some low-impact bugs quiet for up to a year to avoid handing attackers a map to the weak spot. The reasoning was that obscurity bought time. Cheap, fast LLM code analysis broke that assumption. If a model can find a bug in an afternoon, secrecy shields attackers more than users, so the project now patches these flaws across all supported versions and publishes an advisory right away. Three more medium- and high-severity bugs tied to version 30.0 are due to be disclosed within two weeks under the same policy.
Node operators and self-custody, in practice
Most people who hold crypto never run their own node; they trust an exchange, a wallet provider, or a hosted service to do it for them. The people directly exposed here are the operators who run Bitcoin Core themselves, including many who do so precisely because they want full self-custody and independent verification rather than trusting a third party. The fix is straightforward: move to a patched release. Node software is infrastructure, and like any infrastructure it needs maintenance, not a one-time install.
The broader point is about tooling. The same AI code analysis that defenders are now using to harden Bitcoin Core is equally available to attackers probing for the next flaw. Bitcoin Core's answer, faster patches and immediate disclosure, is a bet that openness plus speed beats secrecy in a setting where finding bugs is cheap. The first real test of that bet arrives in two weeks, when the next batch of disclosures lands.
Overview
An AI-driven code scan found three bugs in Bitcoin Core, the dominant full-node software for Bitcoin. The most serious lets a connected peer crash Windows, macOS, and BSD nodes by exhausting their memory; the other two cause a slow memory leak and a reorg-file overflow on older systems. Patches are already merged across supported branches, including version 32.1, so node operators should update. No consensus rules or user funds are at risk, and the Bitcoin price was unmoved. The more durable story is the policy change on October 22: Bitcoin Core now patches and discloses easily found bugs immediately, because large language models have made this class of vulnerability cheap to discover.
