Potential Core Lightning Attack - 8 Suspicious Closes Today \ stacker news

pull down to refresh

Potential Core Lightning Attack - 8 Suspicious Closes Today

7974 sats \ 36 comments \ @ZezzebbulTheMysterious 1 Oct lightning

Was running Core Lightning 26.07-1 from BTCPay, now updated to 26.08.
I have disabled new channel creation for now by setting:

bitcoin-lightning-cli setconfig min-capacity-sat 2100000000000000

I am still investigating -- but it looks like at least 5 justice transactions were broadcast today. My node looks like it is missing about 0.2 BTC.

I'm not sure if the funds are actually missing, but it does look like someone is trying to exploit the Justice Bypass bug (or otherwise, one from an hour ago looks like its trying to SPLICE).

Here are the potential attacker nodes I have found so far:

GREENTRINITY 03a1179198e24b0eff64ed0286f8dfcb69816dc6486cefb86c830faf3cdb07bb0c

LOUDTRAWL 02d0d00fe2dad581feae78871bb10b43fb29d76ffd4383b97b7afd9953f4ec5a76

PEEVEDCHIPMUNK 02f4633364b2255d07134e91a03a7d74297e04f1b435e7babcb30468fa98e33fdb

ORANGEGLEE 0234d07b85c392c63e1e8a85788213bbde0cd96d8178df49ad620dbecfd73a2f9e

02512b218bb367eb0946 02512b218bb367eb09464b101f3d98a83f1dcf8022e7f28a9010fe1c0022c8f8a9

03962690a57a7b3c2765 03962690a57a7b3c276580a5a2f31d630664b0ec3474bf1b664fdf83e4cf33bfc5

SOMBERPLOW 02870e583af5f9ca5f5cb3473a279b9e0428b7e0ea5bec36744d4093c9b6cfcf70

WEIRDPHOTO 02c05ea1d8e54ec5f5cdfb351b48d665447e510c300e8d01be500db4562e98cbb2

view all related items

2 sats \ 3 replies \ @Scoresby 2 Oct

Core lightning is now urging people to update.

source

1022 sats \ 1 reply \ @ZezzebbulTheMysterious OP 2 Oct

What's worse is there is another bug in .8 that will crash the onchaind and make jam the channel too. I posted the trace yesterday. I'm still trying to work out what happened here and why its crashing.

Check for "ONCHAIN:Owning subdaemon onchaind died" in the listpeerchannels, however after 100 blocks core lightning will discard it.

.8 cannot recover the left over funds from the force close either -
I would strongly recommend folks disable new channels on core lightning until that crash of onchaind is fixed. There is active exploitation of this --

02512b218bb367eb09464b101f3d98a83f1dcf8022e7f28a9010fe1c0022c8f8a9 hit my node with this, and I cannot get onchaind in .8 to read its state.

206 sats \ 0 replies \ @ZezzebbulTheMysterious OP 2 Oct

And the attacker has swept 'my side' of the stale commitment transaction force closes.

2 sats \ 0 replies \ @nitter 2 Oct

https://twiiit.com/Core_LN/status/2105835841847242976

20 sats \ 0 replies \ @anon 2 Oct

https://mempolitics.com/story/core-lightning-attackers-targeting-unpatched-nodes-2026-10-01/

350 sats \ 14 replies \ @ZezzebbulTheMysterious OP 1 Oct

2026-10-01T01:09:51.441Z BROKEN 03a1179198e24b0eff64ed0286f8dfcb69816dc6486cefb86c830faf3cdb07bb0c-onchaind-chan#2236: Could not find resolution for output 2: did we cheat?
2026-10-01T01:09:51.442Z BROKEN 03a1179198e24b0eff64ed0286f8dfcb69816dc6486cefb86c830faf3cdb07bb0c-onchaind-chan#2236: Could not find resolution for output 3: did we cheat?
2026-10-01T01:09:51.508Z BROKEN 02870e583af5f9ca5f5cb3473a279b9e0428b7e0ea5bec36744d4093c9b6cfcf70-onchaind-chan#2234: Could not find resolution for output 2: did we cheat?
2026-10-01T01:09:51.508Z BROKEN 02870e583af5f9ca5f5cb3473a279b9e0428b7e0ea5bec36744d4093c9b6cfcf70-onchaind-chan#2234: Could not find resolution for output 3: did we cheat?
2026-10-01T01:09:51.547Z BROKEN 0234d07b85c392c63e1e8a85788213bbde0cd96d8178df49ad620dbecfd73a2f9e-onchaind-chan#2230: Could not find resolution for output 2: did we cheat?
2026-10-01T01:09:51.547Z BROKEN 0234d07b85c392c63e1e8a85788213bbde0cd96d8178df49ad620dbecfd73a2f9e-onchaind-chan#2230: Could not find resolution for output 3: did we cheat?
2026-10-01T01:09:51.553Z BROKEN 02d0d00fe2dad581feae78871bb10b43fb29d76ffd4383b97b7afd9953f4ec5a76-onchaind-chan#2232: Could not find resolution for output 2: did we cheat?
2026-10-01T01:09:51.553Z BROKEN 02d0d00fe2dad581feae78871bb10b43fb29d76ffd4383b97b7afd9953f4ec5a76-onchaind-chan#2232: Could not find resolution for output 3: did we cheat?
2026-10-01T01:09:51.558Z BROKEN 03962690a57a7b3c276580a5a2f31d630664b0ec3474bf1b664fdf83e4cf33bfc5-onchaind-chan#2226: Could not find resolution for output 2: did we cheat?
2026-10-01T01:09:51.558Z BROKEN 03962690a57a7b3c276580a5a2f31d630664b0ec3474bf1b664fdf83e4cf33bfc5-onchaind-chan#2226: Could not find resolution for output 3: did we cheat?

This seems to match the attacker justice txs?

125 sats \ 13 replies \ @ZezzebbulTheMysterious OP 1 Oct

I restarted the node, and RBF might have changed the tx? I did not cheat here.

I am highly concerned that these fake channels have been drained.

125 sats \ 12 replies \ @optimism 1 Oct

The other option is WAL corruption, I think? Did you have any errors like running out of disk space?

350 sats \ 11 replies \ @ZezzebbulTheMysterious OP 1 Oct

It didn't run out of disk space. Of the channels that were opened today, I can see at least some of the coin onchain. It looks like only the anchors were swept. There is def an attack going on here.

Ill have to run a deeper chantools to see if these outs are unrecoverable.

235 sats \ 10 replies \ @optimism 1 Oct

Found what they're exploiting, I think: https://github.com/ElementsProject/lightning/commit/c65eec307f993b3d8b4a8fe9672b3b8304175c2e

250 sats \ 9 replies \ @ZezzebbulTheMysterious OP 1 Oct

This matches what I am seeing re: CHANNELD_AWAITING_SPLICE All the attacker channels looked like this -- this is from SOMBERPLOW

{
"peer_id": "02870e583af5f9ca5f5cb3473a279b9e0428b7e0ea5bec36744d4093c9b6cfcf70",
"peer_connected": false,
"channel_type": {
"bits": [
12,
22
],
"names": [
"static_remotekey/even",
"anchors/even"
]
},
"updates": {
"local": {
"htlc_minimum_msat": 0,
"htlc_maximum_msat": 1558593000,
"cltv_expiry_delta": 34,
"fee_base_msat": 1000,
"fee_proportional_millionths": 10
},
"remote": {
"htlc_minimum_msat": 0,
"htlc_maximum_msat": 1558593000,
"cltv_expiry_delta": 34,
"fee_base_msat": 1000,
"fee_proportional_millionths": 10
}
},
"last_stable_connection": 1790796837,
"state": "ONCHAIN",
"scratch_txid": "4a3a4246fa021b49960ef3e7e3cfb2a1278edd7f38d9e9b0646a99bff28a0878",
"last_tx_fee_msat": 1411000,
"lost_state": false,
"feerate": {
"perkw": 1255,
"perkb": 5020
},
"owner": "onchaind",
"short_channel_id": "969346x79x1",
"direction": 1,
"channel_id": "d15dcb8ccc94c74cf0c46f7719f1555413902f434ffa8034e56da74297f11b9a",
"funding_txid": "871b7f86abd319c75d67897b59e90f10f24e9789e0efa64d71272ec1bbfdbeb5",
"funding_outnum": 1,
"close_to_addr": "bc1pkscvdr7pvp63rl07vl9wnrmg28ec5aaky2u0yhqt7ahk6v5ryxas7rjq9k",
"close_to": "5120b430c68fc1607511fdfe67cae98f6851f38a77b622b8f25c0bf76f6d328321bb",
"private": false,
"opener": "remote",
"closer": "remote",
"alias": {
"local": "15388406x15269626x57877",
"remote": "11942166x3538766x39305"
},
"features": [
"option_static_remotekey",
"option_anchors"
],
"funding": {
"local_funds_msat": 1513899000,
"remote_funds_msat": 69026000,
"pushed_msat": 0,
"withheld": false
},
"to_us_msat": 1514899124,
"min_to_us_msat": 0,
"max_to_us_msat": 1514899124,
"total_msat": 1582925000,
"fee_base_msat": 1000,
"fee_proportional_millionths": 10,
"dust_limit_msat": 546000,
"their_max_htlc_value_in_flight_msat": 18446744073709551615,
"our_max_htlc_value_in_flight_msat": 18446744073709551615,
"their_reserve_msat": 15829000,
"our_reserve_msat": 15829000,
"spendable_msat": 1499070124,
"receivable_msat": 47890876,
"minimum_htlc_in_msat": 0,
"minimum_htlc_out_msat": 0,
"maximum_htlc_out_msat": 1558593000,
"their_to_self_delay": 144,
"our_to_self_delay": 144,
"max_accepted_htlcs": 30,
"state_changes": [
{
"timestamp": "2026-09-30T20:04:53.590Z",
"old_state": "CHANNELD_AWAITING_LOCKIN",
"new_state": "CHANNELD_NORMAL",
"cause": "remote",
"message": "Lockin complete"
},
{
"timestamp": "2026-09-30T20:16:18.983Z",
"old_state": "CHANNELD_NORMAL",
"new_state": "CHANNELD_AWAITING_SPLICE",
"cause": "remote",
"message": "Splice signatures sent"
},
{
"timestamp": "2026-09-30T20:54:35.357Z",
"old_state": "CHANNELD_AWAITING_SPLICE",
"new_state": "CHANNELD_NORMAL",
"cause": "remote",
"message": "Lockin complete"
},
{
"timestamp": "2026-09-30T20:54:50.254Z",
"old_state": "CHANNELD_NORMAL",
"new_state": "AWAITING_UNILATERAL",
"cause": "protocol",
"message": "channeld: received ERROR channel d15dcb8ccc94c74cf0c46f7719f1555413902f434ffa8034e56da74297f11b9a: failing channel"
},
{
"timestamp": "2026-09-30T20:59:15.138Z",
"old_state": "AWAITING_UNILATERAL",
"new_state": "FUNDING_SPEND_SEEN",
"cause": "onchain",
"message": "Onchain funding spend"
},
{
"timestamp": "2026-09-30T20:59:15.258Z",
"old_state": "FUNDING_SPEND_SEEN",
"new_state": "ONCHAIN",
"cause": "onchain",
"message": "Onchain init reply"
},
{
"timestamp": "2026-09-30T23:19:20.243Z",
"old_state": "ONCHAIN",
"new_state": "FUNDING_SPEND_SEEN",
"cause": "onchain",
"message": "Onchain funding spend"
},
{
"timestamp": "2026-09-30T23:19:20.468Z",
"old_state": "FUNDING_SPEND_SEEN",
"new_state": "ONCHAIN",
"cause": "onchain",
"message": "Onchain init reply"
},
{
"timestamp": "2026-09-30T23:22:09.273Z",
"old_state": "ONCHAIN",
"new_state": "FUNDING_SPEND_SEEN",
"cause": "onchain",
"message": "Onchain funding spend"
},
{
"timestamp": "2026-09-30T23:22:09.460Z",
"old_state": "FUNDING_SPEND_SEEN",
"new_state": "ONCHAIN",
"cause": "onchain",
"message": "Onchain init reply"
}
],
"status": [
"ONCHAIN:Tracking their illegal close: taking all funds",
"ONCHAIN:All outputs resolved: waiting 84 more blocks before forgetting channel"
],
"in_payments_offered": 16,
"in_offered_msat": 12171712785,
"in_payments_fulfilled": 4,
"in_fulfilled_msat": 1514899124,
"out_payments_offered": 0,
"out_offered_msat": 0,
"out_payments_fulfilled": 0,
"out_fulfilled_msat": 0,
"htlcs": []
},

Eventually these all drop of listpeerchannels, ive taken a copy of what I can.

29 sats \ 8 replies \ @optimism 1 Oct

Maybe you can recover 0f023d4bc23f4d643291c5d5586aac34d0553e761a9548de8994943b0c08b943:3? (with chantools)

148 sats \ 7 replies \ @ZezzebbulTheMysterious OP 1 Oct

The remainder of the channel :-(

The issue is the node isn't seeing these outputs, i think this was a bug in .7?
Ill have to wait the 144 blocks and see if chantools can recover it

view all 7 replies

104 sats \ 0 replies \ @ZezzebbulTheMysterious OP 2 Oct

Right now I believe there are three different attacks from these 8 attackers (or more).

.7 Bug where the channel gets 'jammed' and cannot broadcast the justice tx. Attacker steals funds with a old state and the node loses visibility of (This fixed in .8 -- but funds cannot be recovered 'normally'). Trying to work out how to claim at least the channel remainder. The attacker has claimed their side of the old state commit.
A .7? Bug where the channel is mutually closed with an old state and the attacker takes the full channel balance.
A .8 Bug that crashes onchaind, and so can be attacked the same in attack 1.

So far, these all lead to loss of funds, and they will all eventually 'drop out' and stop being tracked by the client.

109 sats \ 1 reply \ @TonyAgora 1 Oct

Been poking at this from the chain side. Few things that might help:

The ALL-CAPS node names are a dead end. That's just the alias CLN auto-generates from the node id when nobody sets one. The attacker never bothers naming their nodes, so they come out SOMBERPLOW, UNITEDSPORK and so on.

Looks like two different bugs with the same ending, both already patched. One's the splice bug (commit c65eec30, 14 Sep): close after a splice locks and your node rebroadcasts an old revoked commitment, then your own onchaind gives up on the outputs. That's your "did we cheat?" line. The other's the dual-funding RBF one fixed in 26.06.8, where the node ends up watching the wrong funding output completely. Either way they route their balance out through you first and then grab it again on the close.

I followed the money too: on the recent batch every channel was funded straight out of a FixedFloat hot wallet, about one withdrawal per channel. The proceeds run back through round-number consolidations into deposit addresses at another big exchange..

Sorry to all those affected, this one's nasty. Happy to compare txids if people post them.

104 sats \ 0 replies \ @ZezzebbulTheMysterious OP 2 Oct

Tony were you able to recover any of the funds from the onchain force close with the old state? Even just a little bit on your side -- My node does not see these outputs at all. (did we cheat - the broken error).

I believe the node loses visibility of the channel remainder, and would like to see if i can at least claw this back. I suspect there are historically more of these that I may have missed. Id like to claw back whatever I can.

229 sats \ 1 reply \ @ZezzebbulTheMysterious OP 1 Oct

Of the 8 channels, it looks like 5 had broadcast a justice transaction.
I am trying to work out if these funds are lost, or will be claimed when the timer expires.

The ones that did not justice:

WEIRDPHOTO was forced closed
PEEVEDCHIPMUNK was mutually closed
02512b218bb367eb0946 is causing 26.06.8 to crash the onchaind.

lightning_onchaind: Could not find resolution for output 2 (version basedon-v26.06.8)
0x560befdb926c ???
???:0
0x560befdbb245 ???
???:0
0x560befdb6812 ???
???:0
0x560befdb203d ???
???:0
0x7fe488a33249 ???
???:0
0x7fe488a33304 __libc_start_main
???:0
0x560befdb2400 ???
???:0
0xffffffffffffffff ???
???:0

104 sats \ 0 replies \ @ZezzebbulTheMysterious OP 2 Oct

There were no justice transactions. The client reported that it tried to issue them for at least 5 of the attacker channels, but it detected them as broken and dropped them.

The Crash from 02512b218bb367eb0946 is highly concerning and still bugged on .8

104 sats \ 0 replies \ @maximusmaximalistus 1 Oct

https://github.com/ElementsProject/lightning/issues

https://help.blockstream.com/contact

104 sats \ 1 reply \ @TonyAgora 1 Oct

Do you have experimental dual funding enabled? There was an attempted attack on my node which i have documented related to that.

104 sats \ 0 replies \ @ZezzebbulTheMysterious OP 1 Oct

I did explicitly check for this when i saw that attack against you. It was disabled on my node. In this at least one of the attacks it was CHANNELD_AWAITING_SPLICE.

I think it’s similar to:

https://github.com/ElementsProject/lightning/issues/9578

104 sats \ 1 reply \ @TonyAgora 1 Oct

omg i just realized you replied to me a month ago in defense of blockstream's handling of the situation

#1555848

i hope you're willing to help me share in frustration that they have let us users down!

104 sats \ 0 replies \ @ZezzebbulTheMysterious OP 1 Oct

Frustrated, yes. I don’t really blame anyone except myself for not patching sooner. I’ve been offline for a few days to discover this. Something told me to check the node. Gulp.

It’s a rock and a hard place. if attacks are being discovered from git diffs, it’s hard to defend patching in the open, but we must in open source software. The LLMs see through the subterfuge that devs relied on in the past to smuggle fixes.

104 sats \ 3 replies \ @ZezzebbulTheMysterious OP 1 Oct

Either i hit a bug while trying to claim the justice tx's (or the attacker did something?), and the tx disappeared from listpeerchannels.

I have closed all channels to the node. There were several that got stuck unable to negotiate fees (even with ignorefeelimits=true).

Im going to have to let this settle, await the timeouts and run chantools and see if any of those justice tx's failed. I think this will be a loss today.

2 sats \ 1 reply \ @Scoresby 1 Oct

I'm sorry for you. These things can really be frustrating and it sounds like you have a lot of sats on the line.

I wish I was better at lightning and able to provide some kind of insight. Hang in there.

104 sats \ 0 replies \ @ZezzebbulTheMysterious OP 1 Oct

Thanks Scoresby. I might need to hand over the database to the developers.

At least one tx today is crashing onchaind on 26.08, which I believe is a bug that was meant to be patched in this version. I suspect this might be to block any justice transactions on the node because it cannot see the tx state onchain.

This is a mess and I have had to close the remaining channels to mitigate this and future losses.