CryptoSlate
ACINQ urged Bitcoin Lightning node operators to upgrade Eclair to version 0.14.5 after fixing security flaws that malicious peers could exploit. Released Oct. 20, it is Eclair’s second security-focused update in five days; operators can install it without closing payment channels.
Why it matters
Eclair nodes maintain Lightning payment channels and route transactions, so vulnerabilities involving hostile peers pose potential security and operational risks to infrastructure handling Bitcoin-funded channels. ACINQ has not detailed the newly fixed exploit mechanisms or identified affected versions, and the announcement reported no confirmed attacks or financial losses.
The update follows version 0.14.4, released Oct. 15, which added protections against a browser-based attack involving cached credentials and Eclair’s administrative API. The latest vulnerabilities have not been linked to that earlier issue, but operators who installed 0.14.4 must upgrade again to get the new protections.
Market impact
Operators can stop Eclair, install version 0.14.5 and restart it without closing existing channels, avoiding the blockchain transactions and reconfiguration that channel closures can require. ACINQ also provides signed release files and SHA-256 checksums for verifying software before installation.
The immediate task is clear, but the exposure is not: without a published breakdown of vulnerabilities or affected versions, operators cannot determine from ACINQ’s announcement whether older deployments can safely remain in production.
Frequently asked questions
-
What does Eclair version 0.14.5 address?
It fixes security flaws that malicious peers could exploit. ACINQ has not detailed the exploit mechanisms.
-
Why is the latest Eclair release notable?
Version 0.14.5 is Eclair’s second security-focused update in five days. The earlier release was version 0.14.4.
-
Do operators need to close Lightning payment channels to upgrade?
No. Operators can stop Eclair, install the update and restart without closing existing payment channels.
-
Did ACINQ report confirmed attacks or financial losses?
No. The announcement reported no confirmed attacks or financial losses.
-
What information remains unclear to Eclair operators?
ACINQ has not specified affected versions or published a detailed breakdown of the newly patched vulnerabilities.
Glassnode
CoinDesk
CoinTelegraph
Lookonchain
TheBlock