Bitcoin Lightning Network software Core Lightning indicates that in a recent batch of security reports generated by AI, multiple have been confirmed to involve real vulnerabilities. The development team is coordinating repairs and reminds node operators to complete signature verification and installation as soon as possible after the new version is released.
Details will not be made public for the time being within two weeks.
The project team stated that they have spent several weeks reviewing a large number of CVE reports generated by AI, and have been intensively working on repairs in the past 10 days. For security reasons, the specific number of vulnerabilities, the methods of attack, and whether they have been exploited will not be made public for the time being. A period of at least two weeks will be reserved for developers to release patches and operators to complete upgrades.
Core Lightning also indicates that a minor version update was originally planned to be released within a few days, but it was later decided to release a signed, reproducible binary file instead, so that node operators could verify and deploy it more quickly.
Use offline mode when upgrading is not possible.
The project team would like to remind everyone that it is not recommended to directly shut down nodes. If an upgrade is not possible for the time being, you should use the -- offline parameter to restart the node. This will stop the connection with other Lightning Network nodes and prevent further payment forwarding, but the background program will continue to run and monitor the Bitcoin mainchain.
This is because most payments on the Lightning Network occur off-chain, and they are only settled back on the Bitcoin chain when the channel is closed. If the counterparty initiates a forced closure, the nodes that are still running can respond in time; however, nodes that are completely shut down are unable to handle such situations, which poses a higher risk.
- Offline mode will stop payment routing and peer connections.
- Nodes can still continue to track the status on the chain.
- Old versions will no longer be supported.
The project team stated that earlier versions, including 26.04, will cease to be supported, while version 26.09 is still planned to be released in late September.
AI Speed up vulnerability discovery
This warning also reflects that AI is accelerating the discovery of vulnerabilities in the Bitcoin ecosystem. In July, hardware wallet manufacturer Coinkite stated that attackers could use AI to examine old code and find weaknesses in the generation of mnemonic phrases for Coldcard wallets, a issue related to the theft of millions of dollars in Bitcoin. Earlier this month, Bitcoin exchange service Boltz also temporarily suspended its services, as it was suspected that attackers were discovering vulnerabilities faster than developers could fix them.
According to statistics from the volunteer security organization Bitcoin Red Team, AI's auxiliary review has currently identified 4,962 potential issues in 390 Bitcoin projects, of which 85 were initially rated as severe and 635 as high-risk. However, the organization also acknowledges that some of these results may be false positives.
The anonymous developer Calle who participates in this organization stated that the current focus is to identify issues before the attackers do. As AI reduces the barriers to exploitation, even those without a security background can more easily carry out some attack procedures that were previously more difficult to perform.
