Abstract

Every implementation of Bitcoin's Lightning payment network disclosed security vulnerabilities in 2026, and every advisory told operators to upgrade. Whether they do has never been measured, because Lightning gossip carries no software version. Matching the feature bits a node announces against the source of every LND, Core Lightning, Eclair and LDK release, we show that gossip reveals a node's release line after all. Where Core Lightning nodes state their version, the inferred line is exact for 132 of 136 node-line pairs. Across 814 daily snapshots of the public graph from 2023 to 2026, the network patches on release and platform schedules, not on disclosures. Half of LND nodes upgrade within 88 days of a release; small nodes and those that skipped releases lag far behind. The three largest upgrade waves came about a day after the Umbrel app store shipped a new LND version. Since June 2025, 17% of LND upgrades came in the 48 hours after a platform release, windows that cover 4.4% of the time. Disclosures, a median 256 days after the fix, moved few operators: of 12 we can test, only Core Lightning's of July 2026 sped up upgrades, and only among nodes one release line behind. Its later call to restart offline was followed mostly by nodes already patched. Two months after Lightning Labs' August 2026 batch, 71% of the LND nodes exposed at disclosure still ran an affected release. For maintainers, the lever on the nodes that lag is the platforms that package their releases.

Introduction

The Lightning Network is a payment network built on Bitcoin. Its nodes run open-source software and hold their operators’ funds in payment channels, so a flaw in that software can put those funds at risk. Between July and October 2026, every major Lightning implementation disclosed security vulnerabilities. Lightning Labs published ten LND advisories on a single day^[1] and eight more a month later^[2]; Core Lightning (CLN) asked operators who could not upgrade to restart their nodes offline^[3]; Eclair and LDK shipped security releases. Each advisory ends with the same advice: upgrade. Whether operators do, and how fast, decides how long a disclosed vulnerability stays exploitable, and by October CLN’s maintainers reported attacks on unpatched nodes ^[4]. For web servers, browsers and Bitcoin and Ethereum full nodes, how fast operators patch has been measured for two decades^{[5, 6, 7, 8, 9]}. For the Lightning Network it has not, because Lightning gossip carries no software version: earlier studies could tell which implementation a node runs^{[10, 11, 12]}, not which release.