Core Lightning Sounds Alarm as Attackers Target Outdated Bitcoin Nodes

Operators of Bitcoin Lightning Network nodes received an urgent warning Friday to update their software immediately after developers confirmed that attackers are actively hunting systems still running outdated versions of Core Lightning.

The open-source implementation, which powers a significant of Lightning infrastructure, singled out version 26.06.7 and all earlier releases. The development team said it had received reports of malicious actors targeting unpatched nodes, though it stopped short of identifying which specific vulnerabilities are being exploited or whether any funds have been stolen.

"Urgent security update: If you're running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible," the Core Lightning team said in a statement shared on social media. Blockstream, the Bitcoin infrastructure firm, amplified the call to action on X, telling node runners the situation "is urgent."

The warning caps a six-week stretch of unusually intense security activity for the project, which has now pushed out two vulnerability-focused releases since late August. Version 26.06.8 arrived on September 22, roughly six days after developers disclosed they were investigating a potential problem involving experimental features that could put user funds at risk.

What Version 26.06.8 Actually Fixed

The September release bundled ordinary bug fixes with patches for flaws reported through responsible disclosure channels. Release notes credited the Bitcoin Red Team, a security-focused group within the Bitcoin ecosystem, alongside twelve named researchers and organizations. Several anonymous contributors were also acknowledged.

Publicly visible changes in the changelog addressed three distinct classes of problems. One flaw could crash a sender's node under certain conditions. Another allowed requests to exhaust memory through Core Lightning's REST interface, creating denial-of-service conditions. Most concerning was a channel-closing bug that could trigger the network's penalty mechanism, causing a user to forfeit funds when attempting to settle a payment channel.

Those disclosures, however, do not establish that attackers are now exploiting any of those specific weaknesses. Core Lightning has only said it received reports of targeting against unpatched nodes.

In an unusual move, the development team temporarily withheld certain diagnostic tests from the public code repository. The stated rationale was to prevent would-be attackers from reverse-engineering the patches while operators were still in the process of upgrading. The release itself carried no formal embargo.

A Wave of AI-Generated Vulnerability Reports

The current alert follows a security cycle that began in August, when Core Lightning confirmed it was processing an unusually high volume of Common Vulnerabilities and Exposures reports generated by AI-assisted tools scanning publicly available source code. Many of those machine-generated submissions did not identify genuine threats, forcing developers to manually verify each report to separate legitimate flaws from false positives.

That review process ultimately confirmed several authentic vulnerabilities. Version 26.06.7 was released on August 28 to address them, with the project initially withholding source code for two weeks. The delay was designed to give operators time to update before attackers could compare patched and vulnerable versions to identify the underlying flaws. The source became public on September 11.

The sequence has fueled a broader debate over whether increasingly capable AI systems are accelerating vulnerability discovery for defenders and attackers simultaneously. A separate industry initiative has called for greater access to advanced AI models for vetted Bitcoin security researchers.

For operators who could not immediately apply the August update, Core Lightning recommended activating offline mode as a temporary protective measure. That configuration disconnects a node from Lightning peers and halts payment processing while allowing the daemon to continue monitoring the Bitcoin blockchain for channel-related transactions.

Lightning's Broader Security Record in 2026

The Lightning ecosystem has weathered multiple security incidents this year beyond Core Lightning. In August, BTCPay Server disclosed an active exploit affecting installations that had not upgraded to version 2.4.2. The flaw exposed LND administrator macaroon credentials, which carry extensive permissions over associated Lightning wallets. Funds were drained from some affected nodes, and BTCPay later backed a recovery bounty of 10%, capped at 3 BTC.

Days earlier, Zeus Wallet temporarily took its backend infrastructure offline following a cyberattack. The self-custodial Lightning wallet said the incident was contained within hours and customer funds were neither lost nor placed at risk. Users whose Lightning Service Provider channels were closed during the incident were promised replacement channels after services resumed.

Even Bitcoin Core, the reference implementation for the Bitcoin protocol itself, disclosed a high-severity vulnerability in May. Tracked as CVE-2024-52911, the flaw could allow a miner to remotely crash vulnerable nodes running releases after version 0.14.0 and before version 29.0. Developers had already patched the issue in Bitcoin Core 29.0 before public disclosure. The vulnerability involved the script interpreter during block validation, where a specially constructed invalid block could cause a node to access freed memory. Exploitation required producing a block with sufficient proof of work to reach the chain tip, making attacks costly. Bitcoin Core said remote code execution was possible but unlikely due to restrictions on block data.

Lightning Labs also addressed an update_fee exploit in the LND client in August, which allowed channel initiators to manipulate fees and potentially leave counterparties with unrecoverable funds. The fix shipped in LND version 0.18.3-beta.

What the Alert Means for the Network

As of May 30, 2026, the Lightning Network consisted of approximately 17,436 public nodes, 40,986 public channels, and roughly 4,870.8 BTC in channel capacity. Failures at the node-software level could threaten the reliability of significant portions of Bitcoin's payment ecosystem.

The exposure from the current alert depends on how a user accesses Lightning. Operators running their own Core Lightning node control the software version directly and are the clearest audience for the upgrade warning. Users relying on custodial wallets or hosted Lightning infrastructure generally depend on their provider to maintain the underlying nodes.

Core Lightning's current alert does not indicate a network-wide failure. Different Lightning implementations use separate codebases, and the warning specifically concerns older Core Lightning releases. But the repeated patch cycle makes update speed an operational issue for Lightning businesses. Exchanges, payment companies, and routing-node operators may need tighter processes for deploying security releases when disclosure windows are deliberately shortened.

Despite the security challenges, investment in Lightning payment infrastructure remains robust. Tether, the issuer of the USDT stablecoin, led an $8 million funding round in December 2025 for Speed, a company focused on global payment settlements using Bitcoin Lightning and stablecoins. Tether has emphasized the rapid growth in Lightning-based payment systems, noting that Speed processed more than $1.5 billion in annual payments and serves 1.2 million users and businesses.

The most important unresolved question is whether Core Lightning eventually identifies the vulnerability being targeted and confirms any successful exploitation or financial losses. Additional technical disclosure may clarify whether attackers are exploiting a flaw patched in 26.06.8, one addressed during the earlier 26.06.7 security cycle, or another weakness affecting older releases.

For now, the evidence supports an active targeting warning rather than a confirmed large-scale compromise. The material indicators are verified fund losses, technical details of the attack vector, and data showing how much of the Core Lightning node base has migrated to version 26.06.8. Analysts expect that continued adoption and new capital inflows will further heighten the importance of security for firms building on Lightning technology.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.