Lightning's Zero-Cost Exploits
Core Lightning developers issued a critical alert urging immediate node upgrades against what they characterise as an active exploit, per coverage. Separately, researcher Erick Cestari disclosed an Eclair vulnerability in which unfunded channel requests accumulate without cost until the node crashes — persisting through restarts until patched. Both affect Lightning implementations rather than Bitcoin's base layer. Operators of either implementation are urged to update.
Lightning: the flaw that costs the attacker nothing
The scary detail in the Eclair bug isn't the crash. It's that an attacker can trigger it without spending a single satoshi on-chain.
Normally, opening a payment channel on Lightning means committing real Bitcoin to the blockchain. That cost is the natural brake on spam. Researcher Erick Cestari found Eclair miscounted unfunded channel requests, so a malicious peer could pile up fake channel records for free until the node ran out of memory. In his test, 47 minutes to kill it.
And the records sat on disk, so restarting just crashed it again.
Here's why a crash matters more than it sounds: a Lightning node that's down can't watch its own payment channels. The bug doesn't steal your coins — it blinds the guard. What a dishonest channel partner does while you're offline is the real exposure.
This worries me more than the Core Lightning exploit running alongside it, which its developers characterise as actively exploited. Lightning is meant to be Bitcoin's cheap, fast payment layer. A whole class of attacks that cost the attacker nothing cuts against the one thing that makes the base layer trustworthy: doing anything has to cost you something real.
The base layer still charges. The layer above it, this week, didn't.
Related storylines
- Lightning's Third Toolkit PatchesLightning Network toolkit security patches across implementations
3 sources
- Unpatched Eclair Bitcoin Lightning nodes could crash again every time they restart · cryptoslate.com · T2
- Core Lightning urges urgent node upgrade after active exploit targets Bitcoin network · en.coin-turk.com · T2
- Active Exploits Hit Core Lightning: Developers Issue Critical Security Alert · blockonomi.com · T2