Summary
Bitcoin.org has reason to suspect that the binaries for the upcoming Bitcoin Core release will likely be targeted by state sponsored attackers. As a website, Bitcoin.org does not have the necessary technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the Bitcoin community, and in particular the Chinese Bitcoin community to be extra vigilant when downloading binaries from our website.In such a situation, not being careful before you download binaries could cause you to lose all your coins. This malicious software might also cause your computer to participate in attacks against the Bitcoin network. We believe Chinese services such as pools and exchanges are most at risk here due to the origin of the attackers.
Mitigation
The hashes of Bitcoin Core binaries are cryptographically signed with this key.We strongly recommend that you download that key, which should have a fingerprint of 01EA5486DE18A882D4C2684590C8019E36C2E964. You should securely verify the signature and hashes before running any Bitcoin Core binaries. This is the safest and most secure way of being confident that the binaries you’re running are the same ones created by the Core Developers.
https://bitcoin.org/en/alert/2016-08-17-binary-safety
今天bitcoin.org发出了安全性警告，提醒大家对下载的客户端进行真实性验证，否则将面临风险。
链接：https://bitcoin.org/en/alert/2016-08-17-binary-safety
在进行验证之前，我们需要做一些准备（基于windows客户端）：
1、下载
bitser，安装后，通过这个软件，可以查看到下载文件的SHA256校验码；网址：http://www.bitser.org/
2、下载
最新版客户端的SHA256SUMS.asc文件，链接：https://bitcoin.org/bin/bitcoin-core-0.12.1/SHA256SUMS.asc
3、下载CORE开发团队用来签名的KEY文件，链接：https://bitcoin.org/laanwj-releases.asc
其指纹是：01EA5486DE18A882D4C2684590C8019E36C2E964
4、下载
Gpg4win ，链接：https://www.gpg4win.org/download.html ，安装。
5、打开command line 界面，使用“
gpg --import laanwj-releases.asc ”导入key文件，
然后使用“gpg --verify
SHA256SUMS.asc"来验证签名，如果得到类似下面结果，就没问题。可以对比一下指纹是否一样。
6、然后用记事本或者notepad打开
SHA256SUMS.asc，再看看和
bitser得到的文件校验码是否一致。如果不一致，就说明有问题。
