If you have been following Bitcoin news, you may have heard about a vulnerability called CVE-2023-50428 that affects Bitcoin Core, the software that runs the majority of Bitcoin nodes worldwide. The vulnerability allows people to embed large amounts of data in Bitcoin transactions by exploiting a loophole in how the software processes certain script patterns. While this does not directly threaten your Bitcoin holdings, it affects transaction fees, network performance, and the ongoing debate about what Bitcoin should be used for. This guide explains the vulnerability in plain language and tells you what you need to know.
The Basics
Bitcoin transactions can include small amounts of arbitrary data alongside the financial information. This is done through something called OP_RETURN, which is essentially a note attached to a transaction. Bitcoin Core limits these notes to 80 bytes to prevent people from clogging up the blockchain with large files. Think of it like a postcard: you can write a short message, but you cannot attach a photo album.
The vulnerability, CVE-2023-50428, reveals that people have found a way around this limit. Instead of using OP_RETURN, they encode their data inside a different part of the transaction called the witness data, using a specific pattern of Bitcoin script opcodes called OP_FALSE OP_IF. Because this data is wrapped in code that looks like a program rather than a plain message, Bitcoin Core’s 80-byte limit does not apply to it. It is like writing your long message in invisible ink on the back of the postcard — the postal service does not check there.
People have been using this technique since late 2022 to create Bitcoin inscriptions, also known as Ordinals. These are essentially NFTs on Bitcoin — images, text, and other data permanently stored on the blockchain.
Why It Matters
You might wonder why this matters if nobody is stealing Bitcoin. The answer is block space. Every block on the Bitcoin blockchain has a limited capacity of approximately 4 megabytes. When inscription creators embed large files in transactions, they consume block space that would otherwise be available for financial transactions. This means fewer transactions fit in each block, which leads to longer confirmation times and higher fees for everyone.
In late 2023, with Bitcoin trading around $44,167, inscription activity has been a major contributor to elevated transaction fees. At peak inscription periods, sending a simple Bitcoin transaction could cost $10 or more in fees — a significant amount for users in developing countries who rely on Bitcoin for everyday payments.
The vulnerability also raises a philosophical question about Bitcoin’s purpose. Should Bitcoin be a lean, efficient payment network reserved for financial transactions? Or should it be a general-purpose data layer where anyone can store arbitrary information by paying the market rate for block space? The community is deeply divided on this question.
Getting Started Guide
Understanding this vulnerability requires no technical background. Here is what you need to know as a Bitcoin user:
Step 1: Know that your Bitcoin is safe. CVE-2023-50428 does not allow anyone to steal your Bitcoin. It is a policy bypass, not a funds vulnerability. Your private keys and wallet balances are unaffected.
Step 2: Understand the fee impact. When inscription activity is high, you may pay more in transaction fees. Use a fee estimator like mempool.space to check current fees before sending transactions. If fees are elevated, consider waiting until off-peak hours or using the Lightning Network for smaller payments.
Step 3: Learn about the Lightning Network. For everyday Bitcoin transactions, the Lightning Network offers near-instant payments with minimal fees regardless of on-chain conditions. Setting up a Lightning wallet like Phoenix or Muun can save you significant money on transaction fees during periods of high inscription activity.
Step 4: Stay informed. Follow Bitcoin Core development discussions on GitHub and the bitcoin-dev mailing list to track progress on addressing the vulnerability. Any changes to Bitcoin’s relay policy require broad community consensus, which takes time.
Common Pitfalls
The most common mistake is assuming that all data on the Bitcoin blockchain is financial in nature. Inscriptions have made it possible to store arbitrary content, and while most inscriptions are innocuous images or text, it is technically possible to store content that some may find objectionable. Because the Bitcoin blockchain is immutable, any data stored on it remains permanently accessible to anyone who runs a full node.
Another pitfall is confusing the data carrier limit with a hard protocol rule. The 80-byte OP_RETURN limit is a policy setting enforced by individual nodes, not a consensus rule. Miners who choose to include inscription transactions in their blocks are not violating the Bitcoin protocol — they are simply operating under different policy settings than the default Bitcoin Core configuration.
Next Steps
If you are interested in learning more about Bitcoin script and how transactions work under the hood, the Bitcoin Wiki and Mastering Bitcoin by Andreas Antonopoulos are excellent starting points. Understanding the technical foundations will help you make informed decisions about transaction timing, fee management, and the broader debates shaping Bitcoin’s evolution.
Disclaimer: This article is for educational purposes only and does not constitute financial or technical advice. Always consult official Bitcoin documentation and security advisories for the latest information.
the OP_RETURN limit was 80 bytes and people squeezed entire JPEGs through a backdoor. the creativity in this space is unmatched
$30 tx fees to send 50 bucks and the core devs are still debating. at some point you just accept BTC is a settlement layer and move on
fee_market_pilled_ accepting BTC as a settlement layer is where this is heading. layer 2 for payments, main chain for finality. inscription crowd just accelerated the timeline
80 byte OP_RETURN limit and people bypassed it with Forge scripts. bitcoin core devs cant even agree on whether this is a bug or a feature anymore
Anders T. the real question is whether bitcoin is a settlement layer or a data availability layer. you cant be both with 1MB blocks
Anders T. the dual identity problem is unsolvable. if BTC works as both settlement and data layers then fees will always favor the data crowd because they can pay more
Taproot was supposed to bring smart contracts to BTC. instead it brought JPEGs clogging every block. unintended consequences hit different
the postcard analogy in this article is honestly the best way to explain OP_RETURN to normies. 80 bytes is a tweet, inscriptions are a netflix series
the postcard analogy is perfect. 80 bytes is basically nothing and people found a way to attach whole photo albums through the back door
good explainer for non-technical folks. the key takeaway is your BTC is safe but you are paying higher fees because of the blockchain bloat from inscriptions
Danica L. paying higher fees because someone inscribed a JPEG into satoshis is the most cypherpunk problem imaginable. Satoshi did not see this coming
article says it doesnt threaten your holdings. true for now. but if blocks keep filling with JPEG data fee pressure becomes a real usability issue for payments
the fee pressure is already real. inscription spikes pushed tx fees above $30 multiple times in 2024. unusable for small payments
deadflag_ 30 fees to send 50 bucks. ordinals basically made btc useless for payments in 2024. the CVE debate is really about whether bitcoin is a settlement layer or a jpeg gallery
30 dollar fees to send 50 bucks of BTC and core devs are still debating whether inscriptions are valid use of block space. at some point you just accept BTC is a settlement layer
$30 tx fees to send 50 bucks worth of btc. ordinals broke the user experience for anyone not stacking sats in single transactions
blockspace_wars 30 dollar fees to send 50 bucks of BTC basically kills any payment narrative. inscription crowd turned BTC into a data layer and broke the medium of exchange use case
deadflag_ $30 fees to send $50 worth of BTC. meanwhile Lightning sits there with $0 fees and nobody uses it. the irony of bitcoin scaling
CVE-2023-50428 has been known since late 2023 and core devs still havent settled on a permanent fix. the inscription crowd and the bitcoin-is-money crowd will never agree
core devs wont fix it because theres no consensus on what bitcoin is for. store of value crowd wants minimal data, inscription crowd wants innovation. stalemate
Ingrid H. the stalemate is by design. if core devs hard fork to kill inscriptions they split the chain. if they do nothing fees stay high. there is no clean fix
14kb_ there is no clean fix because the two camps want fundamentally different things. one group wants BTC as payments, the other wants it as data layer. you cant fork that away
14kb_ Taproot enabled this mess. the upgrade that was supposed to bring smart contracts to BTC instead brought JPEGs and $30 fees. unintended consequences
taproot_blame_ Taproot made inscriptions cheaper to embed but the OP_RETURN workaround existed before. the CVE is in script validation, blaming Taproot is rewriting history
taproot_blame_ you keep saying Taproot caused this but inscriptions were possible before. Taproot just made them cheaper to embed. the vulnerability is in script validation, not the upgrade itself
postcard analogy was perfect. 80 bytes is a tweet and people turned it into a netflix subscription through script tricks. the creativity is almost admirable