CryptoSlate
An Oct. 21 study found that 71% of 550 public LND nodes flagged in an Aug. 11 security disclosure were still on affected software release lines as of Oct. 13. Only about 10% had upgraded, while 108 nodes were no longer classified as live. The fixes for six vulnerabilities had been available since LND 0.19.0, released 446 days before the warning.
Why it matters
The findings point to a distribution problem as well as an operator response problem. Researcher Saurabh Kumar of Bitcoin Data Labs found that the largest upgrade waves followed releases from Umbrel, which packages Bitcoin node software. In the three biggest waves, 262 to 385 nodes updated, with at least 87% broadcasting new software features within 48 hours of an Umbrel release. But Umbrel distributed those versions 19 to 41 days after the corresponding LND releases.
Across nine LND vulnerability disclosures, the study found no statistically detectable acceleration in nodes moving away from affected software lines. That does not rule out smaller responses, but it suggests public warnings alone did not produce a clear, widespread upgrade surge. Operators already on older releases also took a median 88 days to migrate after LND versions 0.19 through 0.21 became available.
Market impact
The exposure was not evenly spread across Lightning. At the August disclosure, affected release lines represented 14.9% of live LND nodes but 6.4% of channel capacity, excluding an identified managed fleet. That points to a smaller share of payment liquidity on affected lines, though it does not remove the security concern.
The study analyzed 814 daily snapshots of the public network graph and inferred release lines from advertised software features. It could not identify exact patch versions or the platforms used by individual nodes, and nodes that upgrade without broadcasting new announcements may still appear exposed. Actual exploitability also depends on each vulnerability and node configuration. Kumar published the code and aggregate data alongside the preprint.
Frequently asked questions
-
How many flagged LND nodes were still on affected software in October?
The study found that 71% of 550 public LND nodes flagged in August remained on affected software release lines as of Oct. 13.
-
How long had the fixes been available before the August warning?
Fixes for six vulnerabilities had been available since LND 0.19.0, released 446 days before the public warning.
-
What role did Umbrel releases play in Lightning node upgrades?
The largest upgrade waves followed Umbrel releases, which distributed the corresponding versions 19 to 41 days after LND releases.
-
How much Lightning channel capacity was on affected software lines?
At the August disclosure, affected release lines represented 6.4% of channel capacity and 14.9% of live LND nodes, excluding an identified managed fleet.
-
What limits the study's assessment of node exposure?
The analysis inferred release lines from advertised software features and could not identify exact patch versions or each node's platform. Actual exploitability also depends on the vulnerability and node configuration.
CoinDesk
CoinTelegraph
Crypto Rank News
Benjamin Cowen
Glassnode
Crypto News
WuBlockchain