Bitcoin Core 31.0 Private Broadcast Bug May Leak IPs; 31.1 Is Coming

What went wrong in privatebroadcast

Bitcoin Core 31.0, which became the latest stable major release on April 20, 2026, now has an acknowledged privacy bug in the -privatebroadcast feature newly introduced in Bitcoin Core 31.0 that may expose the originator's IP address. Developers have said a fix is forthcoming and will be released with 31.1.

The problem is specific. When private broadcast connects to a peer that advertises v2 BIP324 transport, the first connection is routed through Tor as intended. If that v2 handshake fails, Bitcoin Core retries the connection as v1 without using the proxy, which can reveal the node's IP to the receiving peer.

Who is actually affected

Real exposure is narrow. The bug matters only when all of the following are true:

• You are running Bitcoin Core 31.0 with -privatebroadcast.
• You are broadcasting transactions with the sendrawtransaction RPC.
• Tor is reachable for outbound connections.
• Direct outbound IPv4 or IPv6 connections are allowed rather than blocked by -onlynet or -proxy settings.

If you use wallet RPCs such as sendtoaddress, this bug does not apply to you. For most everyday wallet users, the risk is negligible; the main concern is for privacy-sensitive operators actively using private broadcast.

What to do before 31.1

If you rely on this feature, do not wait for 31.1 to act. Apply the workaround that best fits your setup now.

The fix window should be short, but development momentum is already there. The team has a meta issue to track the pull requests related to private broadcast, and recent coverage has highlighted both the progress and challenges of building meaningful privacy protections into Bitcoin Core. Watch that tracker, test your workaround, and upgrade as soon as 31.1 is released.

Why this is a feature bug, not a system failure

This is a real privacy flaw inside the -privatebroadcast feature newly introduced in Bitcoin Core 31.0, but it is not evidence that Bitcoin's broader privacy model is failing. The leak is confined to a new feature, and developers have already committed to a patch.

There is also a broader reason the issue matters: skeptics have long warned that broadcast behavior could help map addresses to determine IPs at large in Bitcoin. That does not make this a collapse of Bitcoin privacy, but it does explain why the bug deserves attention. The cleaner reading is straightforward: the feature is important, the flaw is real, and the planned fix should contain the exposure.