Bitcoin Core’s new fix closes gap that could redirect funds without stealing keys

Bitcoin Core has added a safeguard against signing transactions that may not bind funds to the payment destination a user approved. The change, merged into Bitcoin Core’s master development branch on Sept. 25, targets a narrow flaw in partially signed Bitcoin transactions, or PSBTs, that could produce a valid signature without protecting the intended output. Bitcoin Optech highlighted the update on Oct. 2. The issue does not expose a user’s private key, but creates a different risk: a signature can remain valid even when the transaction’s recipient is changed under specific conditions.

First reported by CryptoSlate. This page is a short excerpt; the full text is theirs.