Lightning Network faces security threats and wallet hack

Security vulnerabilities have been identified within the Bitcoin Lightning Network ecosystem, affecting both specific wallet applications and node software.

Blink, a Lightning Network-focused wallet, reported a hack on September 19 that resulted in the theft of 6.61 bitcoins, valued at approximately US$ 566,000. Developers stated the vulnerability had been active since October 2023. Blink has since patched the flaw, reimbursed affected users, and established a lifetime reward program. The program offers a 25% reward to individuals who provide information leading to the recovery of funds, with another 25% of recovered assets designated for Bitcoin-related circular economies in the Global South.

Separately, developers of Core Lightning, a major software client for Lightning Network nodes, have issued an alert regarding active attacks against unpatched nodes. Operators running version 26.06.7 or earlier are at risk, as a vulnerability could allow a faulty channel closure to transfer node funds to an opposing party or allow attackers to take nodes offline. A patch was released on September 22 in version 26.06.8.