Bitcoin Core privacy · June–July 2026

When Private Broadcast Could Reveal an IP Address

A new experimental feature was intended to hide a transaction sender’s network address. Under specific conditions, a reconnection bug could do the opposite.

What the feature promised

Bitcoin Core 31.0 introduced an experimental Private Broadcast setting. When a raw transaction was sent through a specific RPC, it was intended to use a privacy network so the receiving peer would not learn the sender’s clearnet IP address or location.

Normal built-in wallet RPCs did not use the feature, so the issue applied to a limited configuration.

Where the leak occurred

The initial Tor connection worked as intended. If the encrypted BIP324 v2 transport handshake failed, however, the program retried the peer using the older v1 transport.

That retry could connect directly over IPv4 or IPv6, bypassing Tor and revealing the sender’s network address. A malicious peer could deliberately interrupt the v2 handshake to trigger the fallback.

A narrow set of conditions

The bug required several conditions at once: version 31.0, Private Broadcast enabled, sendrawtransaction use, reachable Tor, direct clearnet connections, and v2 transport enabled.

Connections to onion and I2P peers remained inside their respective proxies and did not reveal a clearnet address through this path.

Advisory before the fix

On June 6, 2026, Bitcoin Core publicly described the problem, identified affected configurations, and offered temporary protections: disable the feature, disable v2, or route all clearnet outbound traffic through Tor.

Bitcoin Core 31.1 arrived on July 8. The fallback connection was changed to honor the configured proxy, closing the leak.

A chain of decisions

The episode does not mean that Tor or BIP324 had ceased to work. The bug existed at the boundary between them, in the logic for falling back from one transport to another.

It is a compact record of development without hype: a new feature, an edge case, a public warning, temporary mitigations, and a corrective release.

A feature name describes an intention; only the program’s behavior determines the real privacy guarantee.

Historical technical material. The temporary workarounds applied to version 31.0; the fix was released in 31.1.

Unless stated otherwise, the text, conclusions, structure and editorial arrangement were created by the project editors. Facts, quotations and source materials remain attributable to their authors and rights holders.