Tor shut out version 0.4.8, then let it back in for now: update wallets with built-in Tor

If a wallet stopped connecting to its node over Tor at the end of October, it was neither a block nor a hack. The Tor network had stopped accepting old versions of Tor. A week later it let them back in, but only temporarily, and that window is the time to update.

What happened

• June. Tor announced that versions 0.4.8 and earlier "will no longer work on the network at all" after a target date, then set for 1 September 2026. Version 0.4.8 had reached end of life on 1 June. The reason given: newer Tor no longer needs some old fields in the network's directory data, and dropping them saves bandwidth for every client. Older clients expect those fields and break without them.
• 28 October. Tor 0.4.9.15 came out. In it the directory authorities, the servers that publish the list of relays, require two new protocol capabilities from clients. The release notes say it plainly: "Because of this change, Tor versions 0.4.8 and earlier will no longer work on the network."
• 4 November. An emergency release, 0.4.9.16, partly reversed this. Tor's David Goulet explained why: "a large number of outdated clients stuck in restart loops and repeatedly attempting to fetch directory information" were overloading the directory servers. "For the time being, until we can come up with a better long-term solution, the authorities will allow these older clients to rejoin the network to help stabilize the load."

No new cut-off date has been announced. It can come back on any day.

Who is affected

An up-to-date Tor Browser is not: the June announcement said so directly. The problem is applications that carry their own copy of Tor: wallets, peer-to-peer exchanges, messengers. They do not update when the browser does. Their symptom is a wallet that cannot reach a node or a counterparty while everything else on the computer works.

Which apps have updated

• Sparrow 2.5.6 (29 October): "Upgrade the bundled Tor to v0.4.9.5 to meet the client protocols now required by the Tor network".
• Feather 2.9.1 (2 November): "The built-in Tor daemon shipped with the previous Feather release was deprecated." If updating is not an option, the release notes suggest installing Tor system-wide or pointing Feather at Tor Browser's port 9150.
• RetoSwap 1.12.0 (29 October): Tor updated to 0.4.9.14, "with high severity security fixes".
• RoboSats 0.8.8-alpha (3 November): the Android app now embeds Tor 0.4.9 (the change is titled "tor 0.4.8 can no longer bootstrap"), and the desktop app gets a Tor upgrade too.
• eigenwallet 5.0.1 (30 October) has another reason to update. It is a "breaking protocol change": "Both peers must upgrade to start a new swap; existing swaps are not affected."
• Wasabi moved to Tor 0.4.9.13 in 2.8.4 (13 October), and Bisq 2 to 0.4.9.14 in 2.1.14 (15 October). Bisq 2.1.15, released on 5 November, says: "Updating to this version is required to continue trading."

A second reason to update: a compromised certificate authority

On 17 October Mozilla blocked the certificates of eMudhra, a certificate authority whose intermediate certificates had been compromised. Tails, in its emergency release of 23 October, spelled out what that means for Tor users: "Using one of the compromised intermediate certificates, an attacker could impersonate any website, even if the connection is secured with HTTPS. This attack could be performed by a Tor exit node, the Internet service provider of an exit node, or a government. Onion sites are not vulnerable." Tails added that it is not aware of the attack being used by exit nodes so far.

Tor Browser 15.0.26 blocks eMudhra certificates. Sparrow 2.5.6 removed them from its bundled certificate store as well.

What to do

1. Update Tor Browser, and Tails if you use it.
2. Go through every app that carries its own Tor and update it now, while old versions still connect. If an app has not shipped an update since the summer, assume it will stop working again.
3. Where a service has an onion address, use it. An onion connection does not depend on certificate authorities, so the eMudhra problem does not reach it. In the catalogue a service's page lists its onion address when it has one.

Sources: Tor — sunsetting Tor 0.4.8, 23 June 2026 · tor-announce — Tor 0.4.9.15, 28 October 2026 · Tor forum — security release 0.4.9.16, 4 November 2026 · Tails 7.15.1, 23 October 2026 · Sparrow 2.5.6 · Feather — changelog · RetoSwap 1.12.0 · RoboSats 0.8.8-alpha · eigenwallet 5.0.1 · Bisq 2 — releases