lightning

According to monitoring by Olaoluwa Osuntokun, the Chief Technology Officer of Lightning Labs stated that due to the CVE-2026-111943 vulnerability, it is strongly recommended that all lnd, btcd, tapd, and litd users update their binaries or rebuild using Go 1.27.3.The vulnerability involves the compromise of a certificate authority, which may affect the security of the related software.

Lightning Labs announced the launch of LayerTree on the X platform, which is a non-custodial scaling solution based on Bitcoin that can connect with the Lightning Network.According to the introduction, LayerTree utilizes Covenants technology, allowing a single UTXO to be shared by up to 1 million users. Users do not need to stay online to receive funds and can exit at any time through a single transaction, with funds not expiring due to timeouts.

According to Bitcoin News, the Bitcoin Lightning Network development kit LDK has fixed multiple security vulnerabilities, including a channel reconnection vulnerability that could be exploited by malicious counterparties, leading to the theft of funds. The LDK official released versions 0.1.13, 0.2.7, and 0.3-rc3 on October 3, recommending operators interacting with untrusted channel counterparties in production environments to upgrade. Currently, the related disclosures have not confirmed any actual losses caused by these vulnerabilities.

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

Swiss cryptocurrency exchange WhiteBIT announced that it has integrated the Lightning Network, allowing users to deposit and withdraw Bitcoin through this network. This feature is technically supported by Bitcoin infrastructure provider Voltage, with a deposit fee rate of 0.25% and a withdrawal fee rate of 0.15%. Users can complete transactions using QR codes or payment information.WhiteBIT founder and CEO Volodymyr Nosov stated that WhiteBIT's mission is to make blockchain technology more accessible and widely adopted, achieving this goal by providing practical and user-friendly digital asset solutions. The addition of Lightning Network support makes Bitcoin faster and more useful, facilitating users to deposit accounts, send and receive funds, and use Bitcoin in more real-world scenarios.WhiteBIT is headquartered in Zug, Switzerland, and according to CoinGecko data, its trading volume ranks 17th among global exchanges. The exchange stated that this launch supports faster Bitcoin channels, with application scenarios covering remittances, exchange fund transfers, merchant QR code payments, and interoperability with wallets and applications that support the Lightning Network. The Lightning Network was launched in 2018, and this year its trading volume has significantly increased, mainly due to exchanges utilizing the network to transfer funds at low cost and high efficiency.

According to monitoring by Bitcoin News, Core Lightning stated that attackers are targeting nodes still running version 26.06.7 and earlier. The patch released on September 22, version 26.06.8, fixed a channel closure issue that could jeopardize funds, as well as vulnerabilities that could lead to crashes and memory exhaustion.The project has not disclosed the names of the vulnerabilities used by the attackers, nor has it reported any theft of funds. Node operators who have not yet upgraded are becoming the targets of the attacks.

The Core Lightning team, which develops the open-source Bitcoin Lightning Network node software, has issued an urgent alert stating that reports indicate attackers are targeting nodes that have not installed patches, urging operators still running old versions to upgrade immediately. The team stated: "Emergency security update: If you are using version 26.06.7 or earlier, please upgrade to the latest release as soon as possible."Prior to this, Core Lightning began investigating a potential issue that could affect its experimental features and, in turn, impact user funds on September 16, and approximately six days later, version 26.06.8 was released. This update not only fixed several defects but also provided patches for security vulnerabilities reported responsibly by multiple parties, thanking the Bitcoin Red Team and 12 other individuals and organizations in the release notes, while also acknowledging anonymous reporters.According to the changelog, this round of fixes covers a bug that could cause sender nodes to crash, requests that could exhaust REST interface memory, and a vulnerability that could result in user funds facing confiscation losses when closing payment channels. To provide operators with ample upgrade windows and prevent attackers from taking advantage of reverse engineering and exploitation, this version intentionally obscured some testing content. Additionally, in August of this year, the project initiated a collaborative fixing process after reviewing a large number of AI-generated general vulnerability disclosure reports, and two days later released version 26.06.7 to close confirmed vulnerabilities.

Payment company Block announced the integration of the Bitcoin Lightning Network into the x402 payment standard. The x402 protocol can complete verification and unlock data through Lightning Network invoices and payment preimages after the server returns an HTTP 402 payment request.Steve Lee, head of Block's open-source Bitcoin development department Spiral, stated that this integration is aimed at instant, low-cost micropayment scenarios. Block has not yet disclosed the timeline for integrating this standard into Cash App, Square, or Bitkey, and the related Python implementation still needs to be tested through real nodes.

Bitcoin News posted on the X platform that Block has joined the x402 Foundation and is providing Bitcoin Lightning Network support for the AI agent-oriented open payment standard x402.x402 embeds payments directly into HTTP, allowing AI agents to autonomously pay for goods, services, and other agent tool fees. Block stated that the Lightning Network is suitable for the billions of instant, low-cost micropayments expected to be generated by the agent economy.

Bitcoin News posted on the X platform that the x402 Foundation has incorporated the Lightning Network payment specifications into its open internet payment standards. x402 was originally developed by Coinbase, aiming to allow AI agents and applications to automatically complete payments and continue executing tasks upon receiving a "402 Payment Required" response, without the need to create accounts, input credit card information, or manage API subscriptions.The protocol is now governed by the Linux Foundation, with participation from companies such as Cloudflare, Google, AWS, Visa, Mastercard, Stripe, and American Express. With the incorporation of the Lightning Network, AI agents can utilize the Satoshi payment API calls, data, computing power, MCP tools, and other digital resources, and cryptographically prove payments through Lightning Network pre-images.

Bitcoin Magazine posted on X that students from East Texas A&M University announced the construction of the first post-quantum secure solution for the Bitcoin Lightning Network.The Lightning Network is a second-layer payment network for Bitcoin, and post-quantum security generally refers to protective designs against potential vulnerabilities in existing cryptography posed by future quantum computing.

AI predicts derivatives center Fortune Protocol officially launched the AI Lightning Prediction feature in its Agent section.This update further enriches the dimensions of AI predictions and market data. Each prediction round will display UP/DOWN probabilities, AI confidence levels, market price spreads, key influencing factors, and risk information, helping users to better understand AI's judgment on current market trends.At the same time, Fortune has optimized the bi-weekly profit-sharing and refund mechanism, adding bi-weekly profit estimates, profit reconciliation, and refund details, further enhancing the transparency of profit data and fund processing, making it easier for users to understand the profit and refund situation for each cycle in a timely manner.Fortune stated that it will continue to improve the AI analysis, market data, and profit management system in the future, further enhancing the transparency, efficiency, and user experience of trading prediction derivatives.

According to Slow Fog's disclosure, Core Lightning (CLN) has an experimental feature vulnerability that may put user funds at risk. Core Lightning's official statement indicates that they are investigating the vulnerability and recommend that all nodes with experimental features enabled immediately disable them and wait for a patch. High-risk options include --experimental-dual-fund, --experimental-splicing, and --experimental-peer-storage.Slow Fog stated that similar issues were fixed in August, where remote peers could specify arbitrary or even zero fees in channel opening or fund adjustment protocols. Local nodes would sign and write to the database without additional verification, potentially forcing nodes to incur abnormal fees or even trigger a crash loop, leading to long-term offline status for the nodes.Node operators are advised to immediately disable or remove all experimental parameters; do not completely shut down the nodes, but use offline mode to retain on-chain monitoring capabilities to prevent peers from forcefully closing channels while the node is offline; verify signatures after the official patch is released before upgrading, and be cautious of fake patch links shared by impersonating official accounts.

Swiss Bitcoin hardware wallet manufacturer BitBox announced that any BitBox hardware wallet user can create a Lightning Network hot wallet within the mobile BitBoxApp, allowing them to recharge directly from on-chain balances and pay invoices without switching between multiple apps, wallets, or third-party services. This Lightning wallet is derived from the user's existing BitBox backup, eliminating the need to record new mnemonic phrases, while the two wallets remain independent.The Lightning Network side operates as a hot wallet, aimed at small and everyday payment scenarios such as coffee, invoices, and quick transfers, while long-term savings are still managed by the hardware device. Within the BitBoxApp, users can scan and pay Lightning invoices, send and receive Bitcoin, obtain a dedicated Lightning address, recharge from the on-chain wallet, and transfer funds back again.This feature is built on the Breez SDK, making BitBox one of Breez's over 100 integrated partners. It is supported by Spark, allowing users to operate without running nodes, opening channels, or managing liquidity, with funds always kept under the user's control. Breez launched the developer app Glow in August to help developers understand how Lightning wallets operate and build their own products.

Electrum has released version 4.8.2, which includes multiple security fixes and enhances the security of the Bitcoin wallet codebase. The related fixes are based on reports from researchers such as Bitcoin Red Team, Calle, l0rinc, haoxucu, and m0wer.This version addresses a critical backup issue affecting some Lightning wallets that use non-deterministic keys and anchored channels. Previously, the channel backups and full wallet backups of affected wallets may have lacked the keys necessary to transfer funds on-chain after a remote force close request; affected users will receive a warning when starting Electrum and should export a new backup, as the old backup cannot correctly restore funds in this scenario.This version also strengthens Lightning HTLC verification, rejects previously acceptable format errors in xpub/xprv keys, expands the scope of codebase security enhancements, and prevents the Android QR code scanner from reading screenshots. This is the third security-focused version release of Electrum since July, following versions 4.8.0 and 4.8.1.

The platform X-Agent, which builds runnable AI applications using natural language, was invited to participate in the AI Foundation Community Lightning Pitch held at WeWork in Tokyo, engaging with entrepreneurs, developers, investors, and practitioners of AI applications.Discussions on topics such as AI Agents, the implementation of AI Apps, and ecological collaboration took place on-site, allowing participants to further understand X-Agent's product experience that helps users build runnable AI applications through natural language. X-Agent stated that it will continue to deepen its product and community layout in the Japanese market and explore collaboration opportunities with local developers, project parties, and partners.

Cobo co-founder and CEO Shen Yu recalled that he has a deep shadow over ZEC. When ZEC's mainnet launched in 2016, BitMEX set the price ceiling at 10 BTC, which also became the historical high point for ZEC.He stated that shortly after starting to mine on the night of the launch, the transformer of the GPU mining farm was struck by lightning, and since then, ZEC has not appeared in his personal wallet again.

Bitcoin News posted on the X platform that Core Lightning version 26.06.7 has been released, fixing multiple vulnerabilities disclosed responsibly over the past three weeks. The AI-generated security reports for the open-source Bitcoin project have recently increased, and specific vulnerability information will be kept confidential for two weeks to allow node operators to complete upgrades before the technical details and source code are disclosed.Developers warn that immediate disclosure of the fixes could allow attackers to reverse-engineer the vulnerabilities and subsequently attack nodes that have not yet been updated. All Core Lightning node operators should upgrade immediately. Currently, the Docker image is not available, and developers explicitly warn users not to wait for the Docker image.

According to CoinDesk, the developers of the Bitcoin Lightning Network payment software Core Lightning (CLN) issued an urgent warning to node operators after the team received a large number of AI-generated security reports, revealing several real vulnerabilities. The development team advised operators not to directly shut down the machine power but to restart the software in "--offline" mode, which stops communication with other Lightning Network nodes while still keeping it operational to continuously monitor the Bitcoin blockchain and protect the funds in the payment channels.The Core Lightning team began receiving a large number of AI-generated vulnerability reports since early August, some of which have been confirmed to be valid. Developers will keep the details confidential for two weeks to complete the patch development and plan to release a signed patch version for operators to verify the source. The source code and vulnerability details will be made public after the confidentiality period ends.This is the second AI-related security incident in the Lightning Network this month. Earlier in early August, BTCPay Server experienced a vulnerability that led to the leakage of credentials for some Lightning Network nodes and theft of funds. Additionally, the "Bitcoin Red Team," composed of 16 developers, used AI models to scan 390 Bitcoin code repositories at the end of July, discovering nearly 5,000 issues, 85 of which were rated as critical.