Bitcoin Core disclosed three previously patched software vulnerabilities on November 10, 2026: one rated High and two rated Medium. The defects could interrupt mining block construction, weaken protections for certain Tor-connected nodes, or delay block processing. None of the advisories establishes that Bitcoin signatures were forged, its monetary supply was changed, or attackers seized the network. The disclosures provide a timely way to evaluate three more general attack surfaces: implementation code, mining coordination, and peer-to-peer connectivity.
Archival educational video: “Bitcoin Security Models,” featuring John Newbery, linked by the Chaincode Labs Bitcoin protocol curriculum. The presentation is background material, not footage of the November 2026 disclosures. Credit: Chaincode Labs curriculum / original YouTube uploader.
1. Find a software defect where validation meets block production
An attacker targeting the Bitcoin protocol would first examine the software interpreting its rules. A flaw in consensus validation can be exceptionally serious because independent nodes may disagree about whether a block is valid. A defect in relay policy, mining templates, storage, or mempool handling can instead disrupt selected nodes without changing consensus. Bitcoin Core’s security classifications distinguish those outcomes.
The newly disclosed CVE-2025-62861 shows the second category. Certain Bitcoin Core 28.x and early 29.x releases could restore version-3 transactions incorrectly after a chain reorganization. Their mempools could become inconsistent, preventing affected miners from building valid block templates until restart. Bitcoin Core rated the problem High, but the affected behavior was mempool policy, not a network-wide consensus rule. The fix arrived in October 2025, more than a year before public disclosure.
An authorized red team would stress protocol boundaries and edge cases in isolated test networks, not use a mainnet disruption as a demonstration. Earlier BitcoinVersus reporting covered three separately disclosed AI-found node flaws and Bitcoin Core’s revised security-disclosure policy. Neither earlier story covered the November 10 group.
2. Concentrate mining influence rather than brute-force cryptography
A second avenue is majority control of block-producing hash power. Sufficient coordinated mining power can reorganize recent blocks, selectively exclude transactions, or attempt double spending against payments with inadequate confirmations. It cannot simply create valid coins beyond the issuance rules or spend arbitrary addresses without the required signatures; independently validating nodes still reject invalid blocks.
Mining-pool concentration deserves careful measurement. A 21Shares Q3 2026 report attributes 60.0% of blocks to the three largest pools, versus 58.2% in Q2, an increase of 1.8 percentage points. Pool attribution measures observed block production, not collective ownership of machines, a proven alliance, or an actual majority attack. Miners can also redirect hash power. BitcoinVersus previously ranked the largest mining pools and examined why a 51% scenario differs from faster general-purpose computing.
Linked archival equipment photograph posted by Altair Technology: an opened Avalon 1 ASIC miner on display. Mining hardware illustrates the physical capital behind proof of work, not a current attack or a measure of any pool’s hashrate. Credit: Altair Technology / X.
3. Isolate peers or disrupt block propagation
Bitcoin nodes learn about transactions and blocks from peers. An eclipse attack attempts to leave a target node connected only to adversarial peers, potentially hiding the honest chain, delaying information, damaging privacy, or disrupting time-sensitive payment decisions. Bitcoin Optech’s security overview explains why diverse independent peer connections reduce such risks. A targeted node failure does not automatically imply a network-wide compromise.
Two November 10 advisories reinforce the networking risk. CVE-2025-62860 let inbound Tor peers inherit trusted whitelist permissions on nodes with a particular non-default configuration; Bitcoin Core says thousands of reachable nodes used the affected setup. CVE-2025-62859 let a malicious peer stall compact-block processing under specific conditions. Both were rated Medium and patched before publication of the technical details.
Archival technical video: “Bitcoin Peer-to-Peer Network,” cataloged by Chaincode Labs in its protocol-development curriculum. The recording explains networking concepts; its watch page or playback may differ by device and region.
The security lesson is layered, not apocalyptic
Bitcoin has no single central server whose compromise rewrites every node’s rules. Software bugs, mining centralization, and network isolation each create different failure modes, with different costs and defenses. Current Bitcoin Core release lines include fixes for all three November 10 disclosures; operators on obsolete versions should review the relevant advisories and supported upgrade paths. Useful controls include independent node validation, timely software maintenance, diversified network peers, and distributed control over transaction selection.
Professional testing belongs on privately controlled regtest environments or otherwise authorized systems, followed by responsible disclosure. The disclosed issues demonstrate why Bitcoin’s security depends on continuous engineering rather than any claim of immunity to attack.
Primary reporting and documentation: Bitcoin Core CVE-2025-62861 advisory; Bitcoin Core CVE-2025-62860 advisory; Bitcoin Core CVE-2025-62859 advisory; November 10 bitcoin-dev announcement; Bitcoin Optech eclipse-attack overview; 21Shares Q3 pool-concentration figures; Chaincode Labs video curriculum. Calculation: 60.0% − 58.2% = 1.8 percentage points. Earlier mining statistics and video presentations are contextual, not evidence of a November attack.
Editor’s Note: Bitcoin Core published the three advisories on November 10, 2026, after fixes shipped in October 2025. The CVE identifiers refer to earlier reported bugs, not attacks newly discovered in November. The High-severity mining-template flaw did not itself change Bitcoin’s consensus rules; the Tor and compact-block flaws were Medium severity. No chain-wide takeover, coin inflation, stolen private keys, or exploitation campaign was established by the official disclosures. The mining-pool figure measures observed quarterly blocks and does not prove coordinated control. The featured cover is an AI-generated conceptual illustration, not evidence of an attack. Its file measures 1376 × 768, rather than the requested 1200 × 630, and the prescribed bottom-left neon-green watermark was not verified. WordPress renders both archival YouTube videos as iframe players, but actual playback and mobile layout were not tested. The archival X equipment photograph appears as a source link instead of a live X widget.
BitcoinVersus.Tech is volunteer-run and publishes independent educational technology reporting. An optional 5,000-satoshi donation supports ongoing research. Scan the original QR from a second screen with a compatible Bitcoin wallet; on mobile, use a wallet that supports scanning a saved image. Independently verify the recipient address 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb and the payment amount before sending. Bitcoin transfers are generally irreversible.
We volunteer daily to ensure information on the BitcoinVersus.Tech platform is Verifiably True. Coverage is educational and informational and does not constitute financial or investment advice.
Leave a Reply