Bitcoin Core review
Last reviewed 2026-08-25
Security warning
Run Bitcoin Core if you want to stop trusting anyone's server about your own money. It is the most demanding wallet on this list and the only one that downloads and validates the entire chain itself, which means nobody can tell your node that a payment arrived when it did not, and nobody sees which addresses you are asking about. The wallet is built into the same program that has defined the protocol since January 2009.
The security record is not what most people expect. Bitcoin Core publishes every vulnerability it has fixed, dated and described, on its own advisory page, and that page currently lists more than twenty past advisories. Almost all of them are crash and denial-of-service bugs against the node software rather than anything that can move coins: a malformed message that pins the CPU, headers spam that eats memory, a peer that stalls block propagation. The one that could have touched money is CVE-2018-17144, a bug the project disclosed as both a denial-of-service and an inflation vector, fixed on September 18, 2018 in versions 0.16.3 and 0.17.0rc4.
Disclosure is deliberately slow, and it is worth understanding why before a headline alarms you. The project's published policy holds low severity details until two weeks after a major release containing the fix, and medium and high severity details until two weeks after the last affected release reaches end of life, roughly a year later. CVE-2024-52911, a use-after-free in the script interpreter that a crafted block could use to crash a node remotely, was published on May 5, 2026 under exactly that policy: the patch was in released software long before the description was public. The practical instruction that falls out of all this is simple. Run a current release. Bitcoin Core shipped 31.1 and 30.3 on July 8, 2026 and 29.4 on July 13, 2026, and an up-to-date node is on the fixed side of every advisory on that page.
What you give up is convenience. There is no phone app, no price chart, no way to buy anything, and the first sync takes a long time and a lot of disk. If that is too much for the machine you have, Bitcoin Core can run pruned: it still validates every block, then discards the old block data and keeps a much smaller store. Bitcoin Core is also the private backend other wallets connect to, so a common setup is Core running quietly on a spare machine with Sparrow as the interface.
- Made by
- Bitcoin Core project
- Type
- Software wallet
- Runs on
- Windows, macOS, Linux
- Who holds the keys
- self-custodial, keys in a wallet file on a machine that validates every block for itself
- Bitcoin only
- Yes
- Connectivity
- Validates every block itself over the peer-to-peer network, so no third-party server learns your addresses
- Released
- January 2009, as the original bitcoin client
- Coin support
- Bitcoin only, and the reference implementation of the protocol itself
Pros and cons
What works
- Validates every rule for itself, so your balance does not depend on someone else's server being honest
- Bitcoin only, with the keys in a wallet file on your own machine and no account anywhere
- Every vulnerability the project has fixed is published, dated and classified on its own advisory page
- Free and open source, maintained by a large contributor base rather than by a company
- Doubles as the private backend for friendlier wallets such as Sparrow
- Pruned mode still validates every block while keeping a far smaller amount of data on disk
What to watch
- The first sync downloads and verifies the whole chain, which costs hours and a lot of disk space
- Desktop or server only: there is no phone app
- A plain wallet interface with no fiat on-ramp, no price display and no hand holding
- Running an old version leaves you exposed to bugs the advisory page has already described
Worth comparing
- Sparrow WalletThe desktop wallet to coordinate hardware signers and multisig from, with a verification tool that also checks other projects' releases.
- ElectrumThe oldest bitcoin wallet still in active development, and the one whose users are hunted by a fake-update scam running since December 2018.
- Blockstream GreenBlockstream's own Bitcoin and Liquid wallet, whose 2FA cosigning multisig is its reason to exist and has been closed to new accounts since May 2025.
Frequently asked questions
Do I need to run a full node to use bitcoin?
No. Every other wallet here works without one. Running Bitcoin Core removes your dependence on someone else's server for what the rules are and what you own, which is the reason to do it, and it costs you disk space, bandwidth and patience.
Has Bitcoin Core's wallet ever been hacked?
No, and its published advisories are mostly crash and denial-of-service bugs against the node rather than ways to take coins. The one with money at stake was CVE-2018-17144, disclosed as a denial-of-service and inflation bug and fixed on September 18, 2018 in versions 0.16.3 and 0.17.0rc4.
Why was CVE-2024-52911 only disclosed on May 5, 2026?
Because of the project's published disclosure policy. Medium and high severity details are released two weeks after the last affected version reaches end of life, roughly a year after the fix first shipped, so that the patch is widely deployed before the bug is described. The fix came first, the description followed.
How much disk space does Bitcoin Core need?
Enough for the entire block chain plus room for it to keep growing, which in practice means a dedicated drive rather than a laptop's spare gigabytes. Pruned mode is the way around it: the node still validates every block, then discards old block data.
Which version of Bitcoin Core should I run?
The current release of a supported branch. Bitcoin Core published 31.1 and 30.3 on July 8, 2026 and 29.4 on July 13, 2026, and because vulnerability details are only published once the affected releases are out of support, staying current is what keeps you ahead of the advisory page.