Protocol Security
Lightning Network Under Pressure as Node Exploits and Infrastructure Breaches Strike in Tandem
Core Lightning operators scramble to patch dual-funding and splice flaws while custodial systems trace funds to a single persistent adversary.
The past several weeks have tested node runners and custodial rails across the Lightning ecosystem with uncommon severity. According to Fanis in the newly resumed Latest Strikes newsletter, node operators face an intense race between the good and the bad guys
that has already led to confirmed fund theft across active routing channels [s520].
Two distinct defects in Core Lightning have been actively exploited in the wild. The first involves dual-funded channel construction, where an attacker executes a replacement-by-fee (RBF) maneuver on a funding transaction after the initial transaction confirmed but before channel acknowledgement. When the peer signals readiness, the victim node recalculates capacity from the phantom transaction and attributes fake liquidity to the counterparty, allowing genuine funds to be drained from other channels. While patched in commit 5a77a0e, existing affected channels must be suspended with close <id> 0 to halt further theft [s520].
The second vulnerability strikes splicing logic, where a forced close executed after a splice locks but before memory references clear mistakenly relies on obsolete commitments, permitting an adversary to claim the entire balance with a penalty transaction. Beyond node software, the ecosystem faces coordinated operational attacks: on September 19, an adversary accessed an administrative interface at Blink to alter credentials on 35 accounts, followed on October 5 by an exploit against Second's Ark boarding flow. Forensics published by Blink confirmed that both intrusions originated from the exact same Lightning node [s520].
