Nearly half of the Bitcoin network is one undisclosed exploit away from a very bad day.
A network snapshot taken on October 18 revealed that 3,671 of 8,422 self-reported Bitcoin Core peers, a full 43.6%, are running release lines that have already hit end-of-life. That means no patches. No official support. No protection if a known vulnerability gets weaponized.
And someone out there knows exactly which vulnerabilities those are.
What Just Changed
On October 22, Bitcoin Core merged a policy amendment that quietly rewrites how the network handles security crises. Developers can now backport fixes for easily rediscovered vulnerabilities across every actively maintained release line simultaneously, and publish a public advisory at the same time.
Translation: if a bug is bad enough that a motivated attacker could find it on their own, Bitcoin Core is no longer going to wait. They will patch, disclose, and move fast.
This is not how Bitcoin Core has historically operated. The project has long favored a slow, deliberate approach to everything, including security disclosures. This amendment is an acknowledgment that the old pace no longer matches the threat environment.
Why This Is a Bigger Deal Than It Sounds
The 44% figure is the real alarm bell here. Bitcoin nodes are the backbone of network consensus. They validate transactions, enforce rules, and keep the chain honest. A node running unsupported software is not just a risk to its operator. Depending on the nature of a vulnerability, a coordinated attack on a large cluster of outdated nodes could theoretically disrupt transaction propagation, enable double-spend attempts in specific conditions, or create network partitions.
Nobody is saying a catastrophic attack is imminent. But the attack surface is documented, measurable, and sitting at 43.6%.
The updated policy exists precisely because developers know some of these vulnerabilities are not secret. If researchers at Bitcoin Core can find them, so can state-sponsored actors, well-funded exploit shops, and anyone else with enough time and incentive.
What To Watch
The immediate priority for anyone running Bitcoin infrastructure is simple: check your version. If you are not on a currently supported Bitcoin Core release line, you are operating outside the safety net that just got expanded.
For the broader market, watch for any incoming security advisories from Bitcoin Core in the coming weeks. The new policy means disclosures will be faster and more coordinated than before. An advisory dropping alongside a patch is no longer a warning sign, it is the new normal.
Node operators who ignore version hygiene are not just gambling with their own setup. At 44%, they are gambling with the network.