Oct 2CLNReports of attackers targeting old versions
Different bugs, same summer. So what did the network actually feel?
How I measured
Two of my own nodes, watching every day
148
days of the map
A daily snapshot of public Lightning gossip from my LND node, May 1 – Oct 4.
44,774
channel closes
Every block scanned by my own Bitcoin Core node, each close classified.
4
clients told apart
Nodes don't say what they run. I infer it from feature bits and defaults.
Caveat: one vantage point, public channels only. Private channels inside wallets are invisible here.
Quiz 3 · Aug 26 · “restart offline until the fix”
Core Lightning devs asked operators to take nodes offline. What share actually went dark?
A2%
B22%
C50%
D90%
An ordinary dayCLN nodes that drop off anyway
2.3%
Right after the call137 of 624 routing CLN nodes
22%
Who listened most? The biggest nodes (32%) and Tor-only nodes (28% vs 7% for clearnet-only). LND, LDK, Eclair: no change.
Coming back
Half were back within a week. A third were still dark five weeks later.
39%
back by day 3, right after the fix
53%
back within a week
32%
still dark on Oct 4
Share of the 137 CLN nodes that went dark still offline, Aug 27 – Oct 4
Guess the spike
Force closes per day. Are these spikes attacks?
Not attacks: each orange spike is one operator force-closing 20+ of its own channels in a day. Without them, force closes on CLN channels still ran 2.2× normal for two weeks (LND ↔ LND: 0.8×).
Quiz 4
Of the public channels open on Aug 1, how many were gone by Oct 4?
A5%
B15%
C38%
D60%
Normal for 9 weeks: 18%
79% closed cooperatively: calm exits, not panic
10 operators were in 31% of closes
Each square = 1% of the 38,081 public channels on Aug 1 · outlined = gone by Oct 4 (6,833 new ones opened)
So what actually breaks payments?
Which cut more payment routes?
Pick two random nodes: can a 100,000-sat payment find a path? Normally, yes for about 80% of pairs.
ACore Lightning nodes going offline (Aug 26)
BTor DoS wave (Jul 10)
Any normal two days
−3.6 pts
CLN going offlineeverything that dropped those 2 days
−7.8 pts
Tor DoS waveJul 8–10
−16 pts
Observed: drop in node pairs that can route 100k sat, in percentage points, over two-day windows
Back to Quiz 2
Every Core Lightning node, or one single node?
Simulation: take the Aug 25 map, switch nodes off, re-count the pairs that can still route 100k sat.
All ~620 CLN nodes off
−3.7 pts
One node offACINQ, an Eclair hub
−15.9 pts
One hub outweighs a whole client, 4×.
Of the 20 nodes the network can least afford to lose, 19 run LND and 1 runs Eclair.
Simulated removal on the Aug 25 graph · drop in node pairs that can route 100k sat
Three things to take home
1
Node count isn't where the risk is
A fifth of the #2 client went dark on purpose. Routing dipped, other clients didn't notice.
2
Hubs set the blast radius
One well-connected node outweighs every Core Lightning node combined.
3
Look under the client
A Tor attack cut more routes than any Lightning bug this summer. And when a chart spikes, ask who's behind it.
Your turn
What should I measure next?
Scan for our daily, weekly and monthly reports, dashboards, and this full deep dive:
bitcoindatalabs.org
This report: bitcoindatalabs.github.io/deep-dives
Saurabh “Soru” Kumar · Bitcoin Data Labs
Bitcoin Data Labs · TABConf 2026
→ Space PageDown: next · ← PageUp: back · Home/End · digits: jump to slide
P: presenter window (notes, timer, pace) · N: notes here · F: fullscreen · B or .: black screen · ?: close help