I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org.

I have recently been delving deeper and I realized that I never checked the keys.

Is it recommendable/indispensable?

Can I still check the keys once it is up and running?

Will I have to reinstall and download the entire blockchain again?

  • 2
    You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
    – mimo
    Oct 14 '19 at 19:07

Is it recommendable/indispensable?

Yes, it is a MUST not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the bitcoin.org website.

  • Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
  • Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
  • Attacker can launch a man-in-the-middle attack on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website

Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.

In fact, Bitcoin Core developers issued a warning during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.

It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the gitian signature repository to get other signatures and verify multiple signature data through multiple channels.

Can I still check the keys once it is up and running?

You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the /usr/bin/bitcoind. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.

Will I have to reinstall and download the entire blockchain again?

If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.

  • Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
    – Saidjinn
    Oct 14 '19 at 19:39
  • 1
    @Saidjinn for accepting incoming connections, you should set listen=1 in the bitcoin.conf file or pass it as a parameter when starting bitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here
    – Ugam Kamat
    Oct 15 '19 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.