The Summer Lightning Broke (a Little)
Every Lightning implementation shipped security fixes in the same ten weeks — but the bugs were different. We measured how the network absorbed them: one client cohort went dark on command, peers force-closed on it, most of it came back. Everything below comes from daily gossip snapshots and our own Bitcoin node.
Context
What happened
Approximate dates are marked ≈. The Jul 10 event has no public advisory: we observed it in gossip — channels toward Tor-only nodes of every client were disabled at once. The BTCPay incident was an application-layer credential leak (macaroons), not an LND protocol bug.
Q1 · Did the outage show up?
Core Lightning went dark — on command
Share of channels pointing at each client's nodes that their peers marked disabled, daily. A node that goes offline can't announce anything; its peers disable their side of the channel. Other clients are the control group.
Table view
It was Tor-reachable CLN nodes that went dark
Q1 · Who complied, and how fast did they come back?
Bigger operators went dark more; a third were still dark five weeks later
Went dark after the shutdown call
CLN nodes by capacity quintile (Aug 25 → Aug 28)
Still dark, days after Aug 26
CLN nodes that went dark on Aug 27
"Dark" = at least 80% of the channels toward the node disabled by peers, or the node gone from gossip. Some nodes came back briefly and went dark again; counting only nodes that never reappeared even for a day, the share is lower (see the paper).
Table view
Q2 · Did the incidents cause a closing wave?
The big force-close spikes were single operators — but CLN's peers did force-close
Every force close since May, read from the blockchain. Days when one node was party to 20+ force closes are mass-close events: an operator closing many channels at once. Read naively, they look like incidents.
Organic force-close rate, Aug 26 – Sep 8 vs. Jul 1 – Aug 25
Per 1,000 open channels involving each client · 1.0× = no change
Mass-close events, by client of the node at the center
May 1 – Oct 5, 2026
Who drove the early-August closing wave
Table view — all mass-close events
Table view — daily closes
Q2 · Was anything stolen on-chain?
No justice transactions in the incident window
Table view
Q3 · Did capital move?
CLN lost a fifth of its public nodes and capacity; client shares barely moved
Public nodes, change Aug 1 → latest
Nodes with at least one public channel
Node capacity, change Aug 1 → latest
BTC in public channels, both endpoints counted
Table view
Q5 · What did it cost?
Force closes cost ~6× a cooperative close — in sats, not bitcoins
Method & limits
How we measured it
# Reproduce (requires the Bitcoin Data Labs data lake)
python run.py # → data/processed/*.json
python run.py --refresh-labels # after client-inference rule changes