Two Library Bugs Are Quietly Draining Bitcoin App Fees, and Most Devs Haven't Noticed
A silent vulnerability buried inside a widely used Bitcoin library is miscalculating miner fees and disabling the one warning designed to stop users from overpaying, and most of the apps affected have no idea it's happening.
What's Actually Broken
The issue lives inside the PSBT (Partially Signed Bitcoin Transaction) import flow. Two confirmed bugs in the vulnerable library corrupt fee accounting at the exact moment a transaction is being assembled. The result is a double failure: the fee calculation comes out wrong, and the excessive-fee warning that should catch the error never fires.
That combination is dangerous. Users and apps trust that warning as a last line of defense before a transaction goes out. When it goes dark, there is nothing standing between a wallet and a catastrophic overpayment to miners.
Why This Is Bigger Than One Library
PSBT is not a niche format. It is the standard protocol for coordinating multi-signature transactions, hardware wallet signing, and any Bitcoin workflow where a transaction is built across multiple devices or parties. That makes this library's reach wide. Any application that imports PSBTs and relies on this library's internal accounting is currently exposed.
The threat is not theoretical. A miscalculated fee does not just cost a few extra satoshis. In high-value or batched transactions, inflated fees can drain significant funds in a single broadcast. Because the excessive-fee warning is also suppressed, neither the app nor the user gets a prompt to abort.
This is the kind of bug that stays hidden until someone loses real money, and then suddenly everyone knew about it.
What Developers and Users Should Do Right Now
If you are a developer shipping any Bitcoin application that handles PSBT imports, audit your library dependencies immediately. Confirm which version you are running and check whether a patched release is available. Do not wait for a public incident report to motivate the update.
If you are a Bitcoin holder using a wallet or signing tool that supports PSBT workflows, especially hardware wallet coordination or multi-sig setups, ask your provider directly whether they have assessed this vulnerability. Silence from a wallet team right now is not reassurance.
The Market Angle to Watch
Bugs like this rarely move Bitcoin's price directly. What they do move is trust. Institutional adoption of Bitcoin infrastructure, particularly multi-sig custody solutions, depends on the assumption that the tooling is sound. A library-level fee vulnerability that touches PSBT handling chips at that foundation.
Watch whether major wallet providers issue public statements in the next 48 hours. A fast, transparent response is a green flag. Silence is the tell.