Developers have disclosed a security hole in various versions of bitcoin’s Lightning Network software that could cause users to lose money if not updated.

The bug was first made public on Aug. 30 by bitcoin and Lighting developer Rusty Russel and confirmed Tuesday afternoon by Olaoluwa Osuntokun, CTO of startup Lightning Labs.

It’s unclear how much bitcoin, if any, was lost, or how many users were affected.

Multiple Lightning node versions are vulnerable and should be updated immediately, Osuntokun warned a developer mailing list, adding:

“We’ve confirmed instances of the CVE being exploited in the wild.”

An experimental layer-two solution, Lightning aims to allow nearly costless transactions, making bitcoin feasible for mundane transactions such as coffee purchases.

But the bug shows the technology still has problems like any code-based financial product.

“Security issues have been found in various lightning projects which could cause loss of funds,” Russel said in the original posting. “Full details will be released in 4 weeks (2019-09-27), please upgrade well before then.”

Osuntokun emphasized that lightning is still in its infancy.

“We’d also like to remind the community that we still have limits in place on the network to mitigate widespread funds loss,” he wrote, “and please keep that in mind when putting funds onto the network at this early stage.”

Lightning Labs continued the warning on Twitter, reminding users that it’s still possible to lose funds on the network.


Versions affected include all LND releases 0.70 and below, C-Lightning 0.70 and below, and éclair 0.3 and below.

Olaoluwa Osuntokun image via CoinDesk archive

Read more about...

NewsLightning Network
Disclaimer Read More

The leader in blockchain news, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.

This article is intended as a news item to inform our readers of various events and developments that affect, or that might in the future affect, the value of the cryptocurrency described above. The information contained herein is not intended to provide, and it does not provide, sufficient information to form the basis for an investment decision, and you should not rely on this information for that purpose. The information presented herein is accurate only as of its date, and it was not prepared by a research analyst or other investment professional. You should seek additional information regarding the merits and risks of investing in any cryptocurrency before deciding to purchase or sell any such instruments.