Bitcoin Lightning Nodes Told to Go Offline After Critical Bug Discovery

Points of Focus

• Core Lightning operators are urged to install signed binaries or run nodes offline.
• Vulnerability details remain under a two-week embargo, with no public CVE or advisory yet.
• The warning targets Core Lightning nodes, not all Lightning implementations.

Core Lightning node operators have been urged to install forthcoming signed binaries or run their nodes offline as maintainers prepare fixes for multiple reported vulnerabilities. The warning became public on Aug. 26, but the affected code, exploit paths, and severity remain undisclosed under a two-week technical embargo.

Core Lightning operators told to upgrade or go offline

The Core Lightning team said operators should install the signed release once it becomes available. Those who do not upgrade should restart “lightningd” with the “–offline” option, which Core Lightning’s documentation says prevents the node from binding to ports or reconnecting to peers.

Bitcoin Core contributor Mark Erhardt, known as Murch, said he confirmed a Discord message with a Core Lightning maintainer and that operators should take action. Cashu developer Calle amplified the warning on X, calling it a “critical vulnerability” and urging CLN operators to shut down immediately.

🟥 URGENT: Critical vulnerability in Core Lightning

Blockstream developers urge users to shut down CLN Lightning nodes right NOW!

Please let everyone know! pic.twitter.com/4HpobzMs7Y

— calle 🟥 (@callebtc) August 26, 2026

Calle’s wording is stronger than Core Lightning’s public guidance. Maintainers have referred to multiple vulnerability reports and “known risks” but have not published CVE identifiers, severity scores, or technical details showing whether the issues involve theft, remote code execution, denial of service, or another attack path. CLN has not disclosed any fund losses or active exploitation tied to the issues.

AI-generated reports trigger Core Lightning patch response

Core Lightning first reported on Aug. 13 that it had received multiple AI-generated vulnerability reports from several sources over the previous 10 days. Developers said they were validating the reports and preparing fixes before later shifting to a signed-binary release under embargo.

The warning applies specifically to Core Lightning, one implementation of the Lightning protocol. Nothing disclosed so far shows that nodes running LND, Eclair, or other Lightning software share the same vulnerabilities.

The alert follows two recent security disruptions across Bitcoin infrastructure. Boltz disabled swaps on Aug. 3 after reporting increased AI-assisted probing and several contained exploits while saying no user funds were at risk. Four days later, BTCPay Server released version 2.4.2 after attackers exploited a critical flaw that exposed LND credentials and allowed funds to be stolen.

As of Aug. 27, Core Lightning’s GitHub still lists v26.06.6, released July 22, as its latest public release, while its security-advisory page lists no published advisory.