Bitcoin Core ships a test build to fix the privacy feature that leaked privacy

Bitcoin Core, the reference implementation that most of the network's nodes run, released a candidate build of its next minor version, v31.1rc1, on June 29, 2026, and put binaries and release notes up for testing. The release exists mainly to fix something the previous version broke: a privacy bug in -privatebroadcast, a feature that shipped in v31.0 and was supposed to make transaction broadcasting more private, not less.

What -privatebroadcast is meant to do

When a Bitcoin node sends a transaction, it announces it to its peers. A peer that receives a transaction directly from the originating node — rather than seeing it relayed second-hand — can reasonably infer that node created it, and can log the node's IP address alongside it. That linkage is a long-standing privacy weakness: it can tie a wallet's transactions to a network location.

-privatebroadcast, introduced in v31.0, was one of the project's attempts to blunt that. The intended behavior is to broadcast a transaction in a way that does not expose the originator's IP to the peer receiving it. The whole point of the feature is to break the "who sent it" link.

The bug

On June 6, 2026, the project published a disclosure titled "Private Broadcast May Reveal Sender IP Address in Bitcoin Core 31.0." Per that notice — which the Bitcoin Core account amplified on June 11 — the feature "may cause the originator's IP address to be revealed to the receiving peer under certain network conditions." In other words, under some conditions the privacy feature did the exact thing it was built to prevent.

The disclosure does not specify which network conditions trigger the leak, how many users were affected, how severe the exposure is, or whether anyone was deanonymized in practice. What the project did commit to was a fix, "released with 31.1." The v31.1rc1 candidate published on June 29 is the first testable form of that fix.

A release candidate is not a finished release. It is a build put out for testing before a final v31.1 is tagged, so operators who run Bitcoin Core cannot simply "upgrade to the fix" yet — they can test the candidate, but the general remedy arrives when 31.1 ships. No date has been given for that final release.

Timeline, reconciled

The account's own posts (relayed via a Nitter mirror) point to the project's own disclosure page and its own GitHub release notes — so this is effectively the project reporting on itself, which is the appropriate primary channel for a software defect.

• The bug disclosure page is dated June 6, 2026.
• The account's public acknowledgment posts are dated June 11, 2026.
• The v31.1rc1 candidate was posted June 29, 2026.

That is roughly three weeks from public disclosure to a testable fix, and about three-plus weeks from disclosure to the release candidate. It is not clear when the bug was first discovered privately versus when it was disclosed publicly.

Key facts

• v31.1rc1, a minor release following v31.0, was posted for testing on June 29, 2026, with binaries at bitcoincore.org and release notes on GitHub (Bitcoin Core account, June 29, 2026).
• The release's stated purpose bearing on this story is a fix for a privacy bug in -privatebroadcast, a feature introduced in v31.0 (Bitcoin Core account; project disclosure).
• The bug "may cause the originator's IP address to be revealed to the receiving peer under certain network conditions" (project disclosure, "Private Broadcast May Reveal Sender IP Address in Bitcoin Core 31.0," dated June 6, 2026).
• Public acknowledgment posts are dated June 11, 2026; the fix was promised for 31.1 (Bitcoin Core account).
• v31.1rc1 is a release candidate, i.e., a pre-final test build — not the final v31.1 (Bitcoin Core account).

The real-world read

The honest framing is unflattering but simple: a feature marketed as a privacy improvement, added only one minor version ago, could leak the very thing it was designed to hide. That is the opposite of a minor cosmetic bug — it is a failure at the feature's stated purpose, and it landed on users who opted into -privatebroadcast precisely because they cared about the privacy it failed to deliver.

To the project's credit, and worth stating plainly because it is the part paid crypto coverage usually skips: this is an open-source project disclosing its own defect on its own site, then shipping a fix in the open, rather than burying it. There is no marketing spin to discount here — none of this is a press release, sponsored post, or vendor pitch. It is the maintainers documenting their own mistake. That is how it is supposed to work, and it stands in contrast to the sponsored, uncritical coverage that dominates much of the space.

What is conspicuously unsaid still matters. The disclosure's "under certain network conditions" is doing a lot of load-bearing work without detail: the disclosure doesn't quantify who was exposed, under what conditions, or whether the leak was ever exploited. "A fix is forthcoming" and a release candidate are not the same as a shipped, final fix that ordinary node operators are running — until v31.1 is tagged, affected users testing the candidate are the remedy's first line, not its beneficiaries.

There is also noise around the announcement to be careful with. The relayed threads carried sniping — references to Bitcoin Knots (a rival node implementation), old grievances about the datacarriersize documentation and inscriptions, and a jab that Bitcoin Core "fix[es] a bug by updating the documentation." Those are third-party reply-thread jabs, not project statements, and nothing substantiates them as bearing on this specific fix. They reflect long-running community friction over Bitcoin Core's relay policy, not evidence about the IP-leak bug. We flag them as context, not fact.

Opinion, and whose

No forecasts or investment takes are on offer, and we won't manufacture any. The only editorializing comes from anonymous reply-thread accounts (the Bitcoin Knots and documentation jabs noted above), which is opinion, unattributed to any named person, and not something we can verify or endorse. The project itself offered no spin beyond describing the bug and promising the fix.

Sources

• Bitcoin Core (@bitcoincoreorg), June 29, 2026 (via Nitter mirror) — announcement of v31.1rc1, with links to GitHub release notes and test binaries. Project's own channel; near-primary. Not marketing.
• Bitcoin Core (@bitcoincoreorg), June 11, 2026 (via Nitter mirror) — public acknowledgment of the -privatebroadcast IP-leak bug in v31.0 and the promise of a fix in 31.1. Project's own channel. The same thread carried unrelated third-party critical replies (Bitcoin Knots, datacarriersize/inscriptions), treated here as unverified community commentary.
• Bitcoin Core disclosure, "Private Broadcast May Reveal Sender IP Address in Bitcoin Core 31.0," dated June 6, 2026 (linked from the account's posts) — primary source for the bug's description and scope language. Not marketing.

This is news coverage of a software release, not security or financial advice; run your own node's upgrades at your own discretion.