Key Takeaways
- • Bitcoin Core merged a security fix into its development branch on September 25 that addresses a vulnerability in partially signed Bitcoin transactions (PSBTs) where valid signatures could survive changes to the payment recipient without exposing private keys.
- • The flaw specifically involves SIGHASH_SINGLE, a signing mode designed to bind an input to its corresponding output; when no output exists at that position, legacy inputs can produce a reusable signature against other unspent outputs controlled by the same key under specific structural conditions.
- • SegWit v0 transactions offer stronger protections because signatures still commit to the specific coin and amount being spent, though the destination output can remain unbound.
- • The vulnerability does not expose users' private keys but creates a risk where funds could be redirected to unintended recipients if transaction conditions align.
- • Wallet providers must independently review their own signing logic, as the fix currently exists only in Bitcoin Core's development branch and has not yet reached stable release versions.
Summary
Bitcoin Core developers merged a security safeguard into the protocol's master development branch on September 25 to address a narrow but meaningful vulnerability in how partially signed Bitcoin transactions handle recipient verification. Bitcoin Optech brought attention to the update on October 2, highlighting the technical specifics of a flaw that could allow valid signatures to persist even when a transaction's intended payment destination is altered—a risk that distinguishes itself from traditional key-compromise scenarios.
The vulnerability centers on SIGHASH_SINGLE, a signing mode intended to cryptographically commit a transaction input to the output occupying the same position in the transaction structure. The security model breaks down when an expected output is missing from the transaction. For legacy Bitcoin inputs, this missing-output condition can generate a signature computed over a fixed hash value, creating the possibility that the same signature could be reused against other unspent outputs controlled by the identical key if structural conditions repeat.
SegWit v0 transactions demonstrate superior resilience in this scenario because their signatures maintain commitment to both the specific coin being spent and its amount. However, even in SegWit v0 cases, the destination output itself can remain unbound to the signature, leaving theoretical room for recipient manipulation under edge cases. The distinction underscores how signature binding strength varies across Bitcoin's transaction types and signing modes.
Because the fix currently resides only in Bitcoin Core's development branch, wallet software providers and exchanges bear responsibility for independently auditing their transaction-signing implementations. This distributed responsibility model reflects Bitcoin's decentralized architecture, where no single entity enforces security standards across all custodians and service providers. Users relying on wallets that have not yet incorporated similar protections remain exposed to the PSBT edge case, particularly if signing infrastructure handles legacy inputs or operates under unusual transaction structures.
The vulnerability centers on SIGHASH_SINGLE, a signing mode intended to cryptographically commit a transaction input to the output occupying the same position in the transaction structure. The security model breaks down when an expected output is missing from the transaction. For legacy Bitcoin inputs, this missing-output condition can generate a signature computed over a fixed hash value, creating the possibility that the same signature could be reused against other unspent outputs controlled by the identical key if structural conditions repeat.
SegWit v0 transactions demonstrate superior resilience in this scenario because their signatures maintain commitment to both the specific coin being spent and its amount. However, even in SegWit v0 cases, the destination output itself can remain unbound to the signature, leaving theoretical room for recipient manipulation under edge cases. The distinction underscores how signature binding strength varies across Bitcoin's transaction types and signing modes.
Because the fix currently resides only in Bitcoin Core's development branch, wallet software providers and exchanges bear responsibility for independently auditing their transaction-signing implementations. This distributed responsibility model reflects Bitcoin's decentralized architecture, where no single entity enforces security standards across all custodians and service providers. Users relying on wallets that have not yet incorporated similar protections remain exposed to the PSBT edge case, particularly if signing infrastructure handles legacy inputs or operates under unusual transaction structures.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.