A Dangerous Bug in Bitcoin's Lightning Network Has Been Fixed

Bitcoin developer Rusty Russell disclosed Friday the lightning network vulnerability that forced software upgrades in July.

AccessTimeIconSep 27, 2019 at 6:45 p.m. UTC
Updated Aug 18, 2021 at 12:25 p.m. UTC

Presented By Icon

Election 2024 coverage presented by

Stand with crypto

A popular payments network running atop the bitcoin blockchain suffered from a long-standing code vulnerability – one where attackers could drain users’ of their money.

While initially flagged to the public on Aug. 30 by bitcoin developer Rusty Russell, the full disclosure detailing how this vulnerability could be exploited by an attacker was released Friday.

  • Bitcoin Mining in the U.S. Will Become 'a Lot More Decentralized': Core Scientific CEO
    13:18
    Bitcoin Mining in the U.S. Will Become 'a Lot More Decentralized': Core Scientific CEO
  • Binance to Discontinue Its Nigerian Naira Services After Government Scrutiny
    05:10
    Binance to Discontinue Its Nigerian Naira Services After Government Scrutiny
  • The first video of the year 2024
    04:07
    The first video of the year 2024
  • The last regression video of the year 3.67.0
    40:07
    The last regression video of the year 3.67.0
  • “An attacker can claim to open a [lighting payments] channel but either not pay to the peer, or not pay the full amount,” Russell wrote in the full disclosure.

    The lightning network is a Layer 2 payments protocol enabling ultra-fast and nearly costless transactions atop the bitcoin blockchain. In order for users to send transactions across the lightning network, they must open what are called “payments channels” to send and receive funds from other lightning users.

    Without the proper checks, an attacker could pretend to open a new payments channel and send fake transactions. Being duped, an honest user could then send back real money to the attacker not knowing the previous transactions had been completely artificial. It’s unclear how many users fell victim to such attacks.

    Already, all major lightning software clients have been upgraded to fix this vulnerability, according to Russell.

    When asked why it took three months for the vulnerability to be disclosed to users, Pierre-Marie Padiou – the CEO of a company maintaining one of the three most popular lightning implementations – said developers had to err on the side of caution.

    “The problem with this vulnerability is that once you know about it, it seems so obvious,” said Padiou. “Three months is not a long time. It’s a pretty short time because you have to give users the amount of time needed to update. … A lot of users don’t do it.”

    Lightning developers, he added, did not want to risk revealing the vulnerability until absolutely sure no users were at risk.

    “There are always problems. Even on the bitcoin protocol, there have been bugs,” Padiou said, adding:

    “There will always be bugs. What matters the most is how to handle this in the best way to protect users.”

    Acinq software developer Bastien Teinturier image via Twitter

    Disclosure

    Please note that our privacy policy, terms of use, cookies, and do not sell my personal information have been updated.

    CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. CoinDesk has adopted a set of principles aimed at ensuring the integrity, editorial independence and freedom from bias of its publications. CoinDesk is part of the Bullish group, which owns and invests in digital asset businesses and digital assets. CoinDesk employees, including journalists, may receive Bullish group equity-based compensation. Bullish was incubated by technology investor Block.one.


    Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.