Developers of Core Lightning, a software used to send bitcoin over the Lightning Network, have issued an emergency warning to node operators after a flood of AI-generated security reports uncovered several real vulnerabilities.
Core Lightning told operators not to power their machines down, and to restart the software in a mode called “*--offline” *instead, which stops it communicating to other Lightning nodes while leaving it running.
The Lightning Network sits on top of Bitcoin and lets people send BTC quickly and cheaply without recording every individual payment on the blockchain. Core Lightning, or CLN, is one of the main software packages used to run the computers that send and route those payments.
Core Lightning said its small development team began receiving a large number of AI-generated vulnerability reports in early August. Such reports point to places where software might potentially be attacked, leaving developers to check whether the weakness actually works in practice.
Several did, the team said. Developers are keeping the details private for two weeks while preparing software containing fixes, giving operators time to update before attackers can study the changes.
A screenshot of CLN's advice spread across Bitcoin social media on Thursday, and the instruction changed shape as it travelled. The original message told operators who could not immediately upgrade to restart their nodes using --offline, not to power them down. But developers later stressed that operators should not switch their machines off, as a node that stops running can no longer defend the bitcoin sitting in its payment channels.
How the nodes work
Lightning works by letting two participants lock bitcoin into a shared payment channel and repeatedly update who owns how much. When they eventually close the channel, the final balance is recorded on Bitcoin.
A node needs to keep watching the Bitcoin blockchain in case the other side tries to close a channel using an outdated balance. If that happens, the node can respond onchain and protect its funds.
But a machine that has been completely powered off cannot see that happening.
Restarting Core Lightning with --offline instead cuts its connections to other Lightning nodes. No payments can be sent, received or routed through it, but the software keeps running and continues watching Bitcoin.
Core Lightning plans to release signed versions of the patched software first, allowing operators to verify the files came from the development team before installing them. The source code and details of the vulnerabilities are expected to be published after the two-week embargo.