Core Lightning warns node operators to disable experimental features over fund loss risk
Key Takeaways
- •Core Lightning issued a September 15 advisory telling node operators to turn off experimental features because they could lead to loss of funds while the team investigates the newly discovered issue.
- •The advisory does not apply to Bitcoin's main network and marks the second Core Lightning security warning within weeks, following a late-August patch for a separate wave of bugs affecting businesses, payment providers, and individual operators.
- •August's troubles stemmed from a high volume of AI-generated reports, during which operators were instructed to restart nodes with the --offline flag before upgrading to version 26.06.7 as the fix.
- •Technical details of the 26.06.7 fix were published to GitHub on September 11 after a two-week embargo expired, a delay that gave operators time to upgrade before attackers could reverse-engineer the patches.
- •The Lightning Development Kit faced its own security emergency in August with no observed losses or exploited applications, reflecting a broader pattern of AI tools being used to scan open-source Bitcoin code for flaws.
Core Lightning developers have warned anyone running experimental features on the software to disable them or risk losing funds while the team works to understand a recently discovered issue.
The mid-September advisory is the second warning in a matter of weeks, following a late-August patch that addressed a separate wave of bugs that could have affected businesses, payment providers, and individual operators using Core Lightning (CLN) software packages to run nodes on Bitcoin's Lightning Network. The current advisory does not apply to Bitcoin's main network.
New risk warning for Core Lightning node operators
Core Lightning issued the new risk alert on September 15 via X, urging operators to switch off any experimental features they had enabled immediately. The alert was also flagged by blockchain security firm SlowMist in a post on X.
The team did not explain what the experimental feature does or how it could be exploited. The fund-loss risk is nonetheless concrete: these nodes hold BTC inside payment channels and route funds between users. As the team continues its investigation, disabling the features remains the only step it has publicly asked of operators.
An eventful August driven by AI-generated CVE reports
Before the September warning, CLN was working to move past an eventful August caused by a high volume of AI-generated CVE reports — publicly catalogued disclosures of software security flaws. The instruction at the time was to restart nodes with the --offline flag, which cuts peer connections so that no payments route through while the software keeps watching the chain.
By August 28, the CLN team told node operators that upgrading to version 26.06.7 was the fix for the issues that emerged during the month. The technical details of that fix were released to GitHub on September 11, after the two-week embargo expired — a delay that gave operators time to upgrade before attackers could reverse-engineer the patches.
AI tools become a problem for open-source Bitcoin
The Lightning Development Kit (LDK), a separate Lightning Network implementation, faced its own security emergency in August, reinforcing a developing pattern in which AI tools are being used to scan open-source Bitcoin code for security flaws. LDK's maintainers reported no observed losses or exploited applications. Core Lightning and LDK are maintained by separate teams as independent codebases, so each project tracks and discloses its own security issues.
