Bitcoin Software Risk Reaches the Wallet

What changed: Bitcoin Core's 2026 disclosures include a wallet-migration bug in versions 30.0 and 30.1 that could delete unrelated files in a wallet directory, plus an issue in a new private-broadcast feature that could reveal the sender's IP address. Maintenance releases followed, and version 31 became the current major line. These incidents do not show a failure of Bitcoin consensus. They show that wallet tooling, optional features, file operations, release adoption, and delayed vulnerability disclosure form their own security surface.

Who bears risk: self-custody users and node operators can lose privacy or files when a feature behaves differently from its promise. Service providers face broader exposure because one release or configuration can affect many customers. Developers must balance prompt warning, safe fixes, and enough time for operators to update before detailed disclosure helps attackers. Users also bear backup and upgrade complexity. Coverage must state affected versions, required settings, known exploitation, fix version, backup guidance, and confidence level without improvising recovery steps beyond official instructions.

What remains open: public advisories do not always reveal whether an issue was exploited, how many operators used the affected feature, or how quickly services upgraded. Different maintained branches can also carry different fixes and operational tradeoffs. BLAKE should run a permanent release ledger, not a one-day scare headline. Each entry should separate discovery, private report, fix, release, disclosure, observed exploitation, and end of life. It should link checksums and official notes while avoiding instructions that could expose wallets or sensitive system details.