Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Brief description
Core Lightning urges node operators to install signed security binaries or shut down nodes in the face of vulnerabilities involving Bitcoin payments that have not yet been publicly disclosed. Developers will not disclose source code patches for fourteen days, thereby limiting attackers 'ability to reverse engineer fixed vulnerabilities during deployment. Calle criticized the project's initial communication approach, and node closures could require affected operators to carefully manage liquidity and payment channels.
Core Lightning developers have urged node operators to install upcoming security versions or temporarily shut down their systems.
According to Core Lightning, during the centralized ten-day reporting period this month, multiple sources submitted multiple vulnerability reports generated by artificial intelligence. Developers and independent contributors are verifying these submissions to determine whether they expose vulnerabilities that can be exploited that affect flash payments. Core Lightning (also known as CLN) allows users to run payment channels and route Bitcoin transactions outside of the main blockchain.
Blockstream maintains the implementation, as well as independent developers contributing security reviews, software improvements, and broader network support services. Maintainers originally planned to release a regular point version containing security fixes, but the investigation forced them to adopt a different remediation strategy.
Delayed source code patch is designed to prevent attackers from reverse-engineering Core Lightning fix
Developers now plan to distribute signed binaries without providing corresponding source code patches and technical details for a full 14 days. This controlled disclosure method provides operators with extra time to protect their nodes before potential attackers can check the repaired code.
Core Lightning strongly recommends that every operator install upcoming binaries as securely as possible during the ban period. At the same time, users who are unable to complete the upgrade should take their nodes offline until the developer completes a coordinated security response.
Core Lightning lists version 26.06.6 as the latest stable release, while the next major release is still scheduled to be released in September. Core Lightning developer Christian Decker explained that releasing the source code immediately could expose fixed vulnerabilities to attackers looking for them. Comparing patched code to earlier versions often helps researchers identify vulnerabilities and develop effective attacks before users successfully upgrade.
Core Lightning operators must strike a balance between security and payment channel management
As a result, the fourteen-day ban provides node operators with a deployment window before technical information will be made public for broader inspection. However, developers have not disclosed whether the reported vulnerability threatens funding, node availability, user privacy or active payment channels.
Calle, a developer associated with the Cashu ecosystem, described the situation as critical and recommended shutting down affected nodes. In addition, Calle questioned why the operator initially learned of the emergency through Discord screenshots rather than official project communications. Lightning nodes usually hold funds in active channels, so shutting down nodes requires careful liquidity planning, payment coordination, and operational risk management.
