Bitcoin Core v30.2 Fixes a Critical Wallet Handling Vulnerability: Users Must Update Immediately

“There are no small details in Bitcoin. A single byte can be worth billions.”
— Adam Back, CEO of Blockstream, inventor of Hashcash

In January 2026, Bitcoin Core developers released an emergency update, v30.2, addressing a serious vulnerability in the wallet module that affects all versions starting from v30.0. The bug could lead to the unintentional sending of funds to an uncontrolled address when performing certain operations with hardware wallets via the Bitcoin Core interface. While no active exploitation has been observed so far, the team strongly urges all users who rely on the built-in wallet to upgrade to v30.2 as soon as possible.

🔍 What Exactly Happened: A Bug in Transaction Signing

The vulnerability was found in the logic governing Bitcoin Core’s interaction with hardware devices (Ledger, Trezor, etc.) when using Partially Signed Bitcoin Transactions (PSBT). In versions v30.0 and v30.1, under a specific sequence of actions—particularly when re-editing an already initiated PSBT—the software could incorrectly map transaction outputs, resulting in a signature being generated for the wrong recipient address.

As a result, the user—seeing a correct address in the interface—would actually sign a transaction to a technically generated internal address that was unrelated to either the sender or the intended recipient. Funds sent this way became permanently lost, as no private key existed to spend them.

Important: the issue only affects users who use the built-in Bitcoin Core wallet together with hardware devices via PSBT. Users working directly through Ledger Live, Sparrow Wallet, or Electrum are not affected.

🕒 Patch Timeline: From v30.0 to v30.2

• December 15, 2025 — Release of Bitcoin Core v30.0, introducing a redesigned wallet interface and Taproot Assets support.
• January 8, 2026 — Bug discovered by an independent researcher; an urgent v30.1 release issued with a partial fix.
• January 12, 2026 — Edge cases not covered by v30.1 identified; final release v30.2 published with a complete patch.

The Bitcoin Core team issued an official warning: “If you created or edited PSBTs in v30.0 or v30.1, do not broadcast those transactions to the network. Discard them and recreate them in v30.2.”

🛡️ Who Is at Risk?

The vulnerability affects a narrow but important group of users:

• Those using Bitcoin Core as their primary wallet.
• Those interacting with hardware devices via PSBT (for example, in multisig setups).
• Those who re-edited transactions (changed fees, added outputs) before signing.

Users who:

• Use only watch-only addresses,
• Do not work with PSBT,
• Or use third-party wallets connected to Core via RPC,

are not affected.

✅ What to Do: Step-by-Step Guidance

1. Upgrade to Bitcoin Core v30.2

Download only from official sources:

• bitcoincore.org
• GitHub Releases

2. Review Recent PSBTs

If you created PSBTs in v30.0 or v30.1:

• Verify that the recipient address in the final transaction matches your expectation.
• If in doubt, do not send—recreate the transaction in v30.2.

3. Consider Specialized Wallets

For everyday use with hardware devices, the following are often better suited:

• Sparrow Wallet — for advanced users and multisig workflows.
• Electrum — for speed and flexibility.
• Official apps (Ledger Live, Trezor Suite) — for maximum simplicity.

🌐 Why This Matters in 2026

Bitcoin Core remains the “gold standard” for full nodes, but its wallet is increasingly used not by retail users, but by developers, researchers, and institutions. The v30.0 bug is a reminder that even the most battle-tested software can experience regressions during major refactors.

This is especially critical as institutional players—via ETFs—are increasingly running their own nodes. Code reliability directly impacts trust in Bitcoin as a financial backbone.

🔧 Lessons for the Ecosystem: Security Is a Process

The incident highlights the maturity of Bitcoin’s development processes:

• The bug was identified and fixed before mass exploitation.
• Two patches were released within four days, demonstrating strong responsiveness.
• The community received clear, calm, and actionable guidance.

Developers also announced strengthened testing for PSBT workflows, including:

• Automated scenarios involving hardware wallets.
• Independent audits by OpenSats and Brink.
• Deeper integration with HWI (Hardware Wallet Interface).

✅ Conclusion: Trust, but Verify—Especially in v30.x

The Bitcoin Core v30.0 issue is not a failure, but an example of how a mature open-source ecosystem works: a vulnerability is discovered, fixed, and communicated. Still, it serves as a reminder that even official software should never be trusted blindly.

As Adam Back said: “Bitcoin is not protected by code. It is protected by the attentiveness of those who use it.” In this case, that attentiveness begins with upgrading to v30.2.