Bitcoin node security basics

Bitcoin Core does not create a wallet by default, so a plain node holds no keys. The risks are the ones any server has: services reachable from places they should not be, old software, and weak SSH.

RPC stays on localhost

Core's RPC (port 8332) can query and, if a wallet is loaded, spend. By default it listens on 127.0.0.1 only. It becomes reachable from elsewhere only if you set rpcbind and rpcallowip. So the safe configuration is mostly the absence of those lines:

• No rpcbind=0.0.0.0, no wide rpcallowip such as 0.0.0.0/0.
• Never port-forward 8332 on your router.
• If a wallet on another LAN machine needs it, scope both settings to your LAN and use rpcauth. Connect your wallet to your own node shows how, and why an Electrum server is the better answer.

Locally, Core writes a cookie file in the datadir on every start and local tools authenticate with it. No password to leak. Our setup guide ships localhost-only.

Firewall

Block inbound by default and allow SSH. Open 8333 only if you run a clearnet node and want inbound peers. A Tor-only node (Tor and privacy) leaves 8333 closed. On a VPS, add the provider's firewall too.

$ sudo ufw default deny incoming
$ sudo ufw allow OpenSSH
$ sudo ufw allow 8333/tcp comment 'Bitcoin P2P, clearnet node only'
$ sudo ufw enable

Audit what is listening

$ sudo ss -tlnp | grep -E '8332|8333'
LISTEN 0 128   127.0.0.1:8332   0.0.0.0:*  users:(("bitcoind",pid=812,fd=11))
LISTEN 0 128     0.0.0.0:8333   0.0.0.0:*  users:(("bitcoind",pid=812,fd=9))

8332 should show 127.0.0.1 (or your LAN address if you deliberately set up wallet access). If it shows 0.0.0.0 or *, fix it now.

OS, user and SSH

• Run bitcoind as its own unprivileged user, as in the setup guide's systemd unit.
• Apply security updates. unattended-upgrades on Debian or Ubuntu is enough for most home nodes.
• SSH: keys only, password login off, and fail2ban or equivalent on a VPS.
• Install Bitcoin Core only from bitcoincore.org and verify the signatures. Skip dashboard scripts that you pipe from curl into a shell.

Back up the little that matters

You can re-download the chain. Keep copies of bitcoin.conf, your systemd unit and any scripts. A wallet file only matters if you created a Core wallet; most hardware-wallet users have none, and wallet backup is outside this site's scope.

VPS extras

A VPS adds the provider, hypervisor and your console credentials to your risk surface. Use a separate SSH key per server, enable disk encryption if offered, and do not keep anything sensitive on the machine. More in VPS.

What a node does not protect

• Phishing, and malware on the computer you use to spend.
• Exchange failure.
• Address leaks from a wallet that talks to someone else's server. See Tor and privacy.

If you think RPC was exposed

1. Block 8332 at the firewall.
2. bitcoin-cli stop, then check bitcoin.conf for stray rpcbind or rpcallowip lines.
3. Check /var/log/auth.log for SSH brute force.
4. Update Core if you were on an old release.

Day-to-day upkeep is in maintenance; hardware that runs 24/7 is in hardware.

FAQ