TLDR
- Core Lightning urged node operators to upgrade to the upcoming security release or take their nodes offline.
- Developers received several AI-generated vulnerability reports from multiple sources over a 10-day period.
- The team plans to release signed binaries while keeping source-level vulnerability details private for 14 days.
- No confirmed fund losses or active exploitation have been reported so far.
- Bitcoin Lightning capacity has fallen to 3,998 BTC from 5,891 BTC in December 2025, a 32.1% decline.
- Core Lightning’s latest stable public release is v26.06.6, while version 26.09 is scheduled for September.
Core Lightning developers have warned node operators to upgrade to an upcoming security release or take their systems offline. The Bitcoin Lightning implementation received several AI-generated vulnerability reports from different sources during a 10-day period. The team has not disclosed the flaws, but it has described the response as urgent.
Bitcoin Lightning Nodes Face Upgrade Warning
Core Lightning plans to publish signed binaries with fixes while keeping source-level details private for 14 days. Developers said the delay should make it harder for attackers to study the patches and build working exploits before most operators update.
The team initially expected to release a normal point update within days. It later changed that plan and advised operators who cannot upgrade to restart their nodes offline. Older releases, including version 26.04, will not receive support during the security response.
Cashu developer Calle called the issue critical and urged operators to shut down Core Lightning nodes. Christian Decker, a Core Lightning developer, said the team would hold back source patches for two weeks while signed binaries reach users.
Calle also questioned why the first warning circulated through a screenshot from Discord rather than an official Core Lightning account. The project later issued a public notice. Developers have reported no confirmed fund losses or active attacks.
Lightning Capacity Continues to Fall
The warning arrives as Bitcoin Lightning capacity continues to decline. Mempool. space data showed public channel capacity at 3,998 BTC on Wednesday, worth about $313.5 million at the time.
Capacity stood at 5,891 BTC on December 27, 2025. That means the network has lost 1,893 BTC, or about 32.1%, over eight months. Opening and closing Lightning channels still requires settlement on the Bitcoin blockchain.
Core Lightning said several recent bug reports used AI tools. The team is preparing signed binaries and expects to provide a fix within about 48 hours, followed by full vulnerability disclosure after the two-week embargo.
The alert follows recent problems at Boltz, a Lightning, Liquid, and onchain swap service. Boltz disabled swaps on August 3 after months of AI-assisted attacks. The disruption also affected some connected services. Core Lightning’s latest stable public release is version 26.06.6, while the team plans version 26.09 for September. Operators remain under heightened caution.
