AI found a way to crash bitcoin nodes on Windows and Macs. It's now public

AI‑Powered Discovery of Bitcoin Node Crashes

A recent investigation using a large language model identified three previously unknown flaws that can cause Bitcoin Core nodes running on Windows and macOS to crash. The vulnerabilities were disclosed publicly under Bitcoin Core’s newly introduced “easy‑to‑find” bug bounty rules, marking the first set of reports submitted through this streamlined process.

---

How the AI Scan Worked

The research team employed a language‑model‑driven code‑review tool to automatically scan the Bitcoin Core codebase. By prompting the model to look for patterns associated with memory‑corruption, unchecked inputs, and platform‑specific API misuse, the system highlighted sections of the Windows and macOS node implementations that warranted closer inspection. Human reviewers then reproduced the findings in a controlled environment, confirming that each issue could trigger a denial‑of‑service condition.

The Three Reported Flashes

1. Unchecked Buffer Length on Windows RPC Calls – A function handling remote‑procedure‑call (RPC) messages failed to validate the size of incoming buffers, allowing a crafted packet to overflow a stack allocation and terminate the node process.
2. Improper File‑Descriptor Handling on macOS – When the node processes a large number of block files, a race condition can leave a file descriptor in an invalid state, leading to an abrupt abort on subsequent I/O operations.
3. Cross‑Platform Logging Path Injection – The logging subsystem accepts a user‑supplied path without sanitization. Supplying a path that resolves to a protected system directory on either OS causes the node to attempt an illegal write, resulting in a crash.

Each flaw is classified as a denial‑of‑service issue rather than a direct vector for fund theft. Nonetheless, a widespread crash could disrupt network reliability, especially for services that rely heavily on full‑node infrastructure.

---

Bitcoin Core’s New Bug‑Bounty Framework

In response to the growing use of automated analysis tools, the Bitcoin Core development team introduced a set of rules earlier this year aimed at encouraging the reporting of “low‑complexity” bugs. Under this scheme, researchers can submit findings that meet the following criteria:

• The vulnerability is reproducible with a minimal test case.
• The issue does not require deep protocol knowledge to exploit.
• The fix can be implemented without extensive code restructuring.

The three AI‑found crashes satisfy all three conditions, making them the inaugural submissions under the new program. The Core maintainers have acknowledged the reports, assigned CVE identifiers, and merged patches that add stricter input validation, improve file‑descriptor lifecycle management, and sanitize logging paths.

---

What Node Operators Should Do

While the patches are already merged into the latest release, operators running older versions should prioritize upgrading. The steps are straightforward:

1. Backup your wallet and configuration files.
2. Download the most recent Bitcoin Core binary for Windows or macOS from the official website.
3. Verify the download’s PGP signature to ensure authenticity.
4. Replace the existing installation and restart the node.

For those who cannot upgrade immediately, applying the interim mitigations—such as limiting RPC payload sizes and restricting logging directories to user‑writable locations—can reduce exposure.

---

Looking Ahead

The successful use of AI to surface low‑level bugs underscores both the potential and the responsibility that comes with automated security research. As more developers adopt language‑model‑assisted code reviews, the Bitcoin ecosystem will likely see a steady stream of similar disclosures. The new bug‑bounty framework provides a clear, low‑friction path for contributors to report findings, helping keep the network resilient against even the most mundane‑looking flaws.

Stay vigilant, keep your software up to date, and consider participating in the Core bug‑bounty program if you discover anything noteworthy.