Downloads

What's new in 1.2.28

The switch happened. Mainnet block 38841, 2026-09-21 12:00:58 UTC, was the first mined under PoW v2 and the consensus rules v2. This release changes nothing in consensus: a 1.2.26 or 1.2.27 node follows the same chain; a node on 1.2.23 or earlier is off it and must upgrade.

Network. Protocol 102, negotiated per peer: a checksum on every message, misbehaving peers scored and banned for 24 hours, a node behind its peers neither mines nor announces until level, block data synced to disk before the index points at it, and a deadlock present since 0.1.0 that could hang sendtoaddress fixed.

Tor where Tor is blocked. Managed Tor that reaches no peer climbs a ladder on its own — Snowflake, obfs4, webtunnel, meek, from Tor Browser's bundled list — keeps the onion, remembers what worked, and shows Tor's own bootstrap while it does. Bridges of your own go in bridges.txt or the paste box in Options. The releases are also served over Tor at rqzruhh4sm2s3fl6b4mpselkqsaaxebnyptpqhdpt236g57lof7j7sid.onion. See Bitflash on censored networks.

Wallet. Multisig and raw-transaction RPC (createmultisig, listunspent, createrawtransaction, signrawtransaction, sendrawtransaction…) ahead of rules v3; pay-to-script-hash addresses are understood but refused as a destination until that switch is scheduled. One OP_RETURN output per transaction is relayed.

Verify what you downloaded

Put the release files and SHA256SUMS in one directory:

sha256sum -c SHA256SUMS

On Windows, without a shell:

certutil -hashfile Bitflash-1.2.28-windows-with-tor.zip SHA256

Checksums prove the files match each other; a signature proves they came from Bitflash. Import the release key once, then verify the checksum file against it before trusting it:

curl -O https://releases.bitflash.network/bitflash-release-key.asc
gpg --import bitflash-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

The signing key fingerprint is 910A 2B4C CA87 9E81 FB4B  2AEA 1D4A 53D3 B78A A4B8. Check the gpg --verify output names exactly that key — a good signature by some other key means nothing.

The repository helper does this end to end, and refuses anything not signed by the pinned key:

scripts/verify-release.sh latest

The full audit procedure is in release verification.