Core Lightning, one of the major implementations powering Bitcoin’s Lightning Network, has confirmed multiple vulnerabilities and is urging node operators to install a forthcoming security patch or restart their nodes in offline mode.
The project said it received several AI-generated Common Vulnerabilities and Exposures reports from different sources over a 10-day window, and upon review, found that some of them are real.
What operators should do
Developers recommended that operators who cannot upgrade immediately restart their nodes with the “–offline” flag, which prevents payments from entering, leaving, or routing through the node while keeping the daemon active.
This matters because a fully stopped node cannot monitor the Bitcoin blockchain or respond if a counterparty force-closes a channel.
Older releases, including version 26.04, will not receive support during this response, pushing everyone toward the newest builds.
Disclosure strategy and timeline
Core Lightning developer Christian Decker said the team plans to ship signed binaries containing fixes within roughly 48 hours, but will hold back source-level patches for two weeks.
The logic is straightforward: publishing exploit-ready code before most operators have updated would hand attackers a roadmap.
No confirmed fund losses or active attacks have been reported so far, suggesting the response is preemptive rather than reactive.
Shrinking network adds pressure
The alert lands at an awkward moment for Lightning.
Public channel capacity has fallen from 5,891 BTC in late December 2025 to 3,998 BTC as of Wednesday — a decline of roughly 32.1% over eight months.
Less liquidity means higher routing fees and more failed transactions for everyday users.
This is the second AI-related disruption to hit the Lightning ecosystem this year, after swap platform Boltz disabled its swap function on August 3 following months of what it described as AI-assisted attacks.
The newly confirmed flaws are separate from remote denial-of-service vulnerabilities disclosed and patched in earlier releases this spring and summer.
