Most flagged Bitcoin Lightning nodes still run outdated software, study finds
Most flagged Lightning nodes still run outdated software
A new study found that nearly three-quarters of public Bitcoin Lightning nodes flagged in a security warning were still running affected software in October. The research, published Oct. 21 by Saurabh Kumar of Bitcoin Data Labs, examined 550 nodes identified during an Aug. 11 disclosure. As of Oct. 13, 71% had not moved to fixed software lines.
Bitcoin's Lightning Network processes payments outside the main blockchain layer. LND is one of the software programs used to operate nodes on that network.
Key findings from the study
- 71% of 550 flagged public Lightning nodes still used affected software in October.
- Only about 10% upgraded between August and October.
- Patches for six vulnerabilities had existed since LND version 0.19.0, released 446 days before the warning.
- The largest upgrade waves followed platform releases from Umbrel rather than public security warnings.
- Affected nodes made up 14.9% of live nodes but only 6.4% of channel capacity.
What the study found
The study found that security warnings did not lead to clear, widespread upgrade surges. Across nine LND vulnerability disclosures, researchers detected no statistically significant acceleration in nodes leaving affected software lines.
Instead, the largest upgrade waves followed releases from Umbrel, a platform that packages Bitcoin node software. The three biggest waves each involved between 262 and 385 nodes. At least 87% of nodes in those waves broadcast updated software within 48 hours of an Umbrel release. However, Umbrel distributed versions 19 to 41 days after the corresponding LND releases.
Confirmed facts
- An Aug. 11 security disclosure flagged certain LND software release lines as affected.
- As of Oct. 13, 71% of 550 flagged public nodes remained on those lines.
- About 10% upgraded during that period, and 108 nodes were no longer live.
- Fixes for six vulnerabilities had been available since LND 0.19.0, released 446 days before the public warning.
- Nodes took an estimated median of 88 days to migrate from older software when LND versions 0.19 through 0.21 became available.
What remains unclear
The study analyzed 814 daily snapshots using advertised software features to infer release lines. It could not identify exact patch versions. Nodes that upgraded without broadcasting new announcements might still appear exposed. Actual exploitability depends on the specific vulnerability and each node's configuration. The study also could not identify which platforms individual nodes used, leaving the precise role of automatic updates unknown.
Why slow patching matters
The findings show that security fixes are reaching some Lightning operators well after their release dates. Because affected nodes controlled a smaller share of payment liquidity than their share of node count, potential exposure is unevenly distributed across the network. The research points to an unresolved question: how to reduce the weeks or months between releasing security fixes and getting them installed across Lightning's public network.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.