Key Takeaways
- • Three Lightning Network implementations (LDK, Core Lightning, and ACINQ's Eclair) shipped critical security patches within a roughly two-week window in September 2026, with no confirmed losses attributed to any of the bugs as of September 23, 2026, according to the supplemental coverage.
- • Lightning Development Kit (LDK) released v0.2.6 on September 9, 2026, fixing a splice fee allocation flaw that could let a malicious channel peer redirect counterparty funds, and a state-loading bug that could prevent nodes from reloading saved channel state after shutdown.
- • ACINQ released Eclair 0.14.3 on September 14, 2026, closing three peer-triggered vulnerabilities affecting channel closures, splicing, and on-the-fly channel funding, which could push balances toward miners as fees or strand funds mid-transition.
- • Core Lightning fixed a denial-of-service memory-exhaustion bug in version 25.09 (with a 26.06.7 backport), but on September 15, 2026, its maintainers warned operators to disable experimental features while investigating a separate, still-unresolved issue that could put funds at risk.
- • The affected public Lightning capacity is estimated at roughly $410 million to $485 million, a small fraction of Bitcoin's total market capitalization, and none of the disclosures carries a CVE number as of the supplemental coverage.
Summary
Three independent teams that build Bitcoin's Lightning Network software disclosed and patched critical bugs in September 2026, according to supplemental web coverage of the disclosures. Lightning Development Kit (LDK), maintained by Spiral, shipped v0.2.6 on September 9, 2026. The release addressed a splice fee allocation flaw that could allow a malicious channel peer to manipulate fee accounting during a splice and redirect part of a counterparty's funds, along with a bug tied to duplicate payment hashes in the ChannelManager that could stop a node from reloading its saved channel state after shutdown. LDK's toolkit underpins products including Breez's SDK and Cash App's Lightning integration, so downstream applications remained exposed until they shipped the update.
ACINQ released Eclair 0.14.3 on September 14, 2026, fixing three separate peer-triggered vulnerabilities touching channel closures, splicing, and on-the-fly channel funding. The flaws could be used to push local balances toward miners as fees or to strand funds during a cooperative close, splice, or funding event. Eclair underpins ACINQ's Phoenix wallet.
Core Lightning (CLN) addressed a denial-of-service path reported by developer Erick Cestari through responsible disclosure, according to Bitcoin Optech Newsletter #421. The bug, which affected versions before 25.09, allowed an attacker to exhaust a target node's memory through oversized pong responses, and the fix shipped in pull request #8525 and the 25.09 release, with a parallel 26.06.7 build for nodes on the earlier major version. On September 15, 2026, CLN maintainers separately told operators to disable experimental features while they investigated a distinct issue that could put funds at risk. That investigation remained open at the time of the supplemental reporting.
Across the disclosures, none has a confirmed dollar loss, and each bug sat in channel state, fee negotiation, or shutdown and restart logic rather than in the base cryptography. Coverage also notes the falling number of public Lightning nodes, from roughly 20,700 at the 2022 peak to an estimated 17,000 to 17,400 as of September 2026, and public channel capacity of roughly $410 million to $485 million at Bitcoin's reported price of about $86,600 on September 23, 2026. Note that these capacity figures are estimates drawn from the supplemental sources rather than from the primary article, which could not be retrieved.
ACINQ released Eclair 0.14.3 on September 14, 2026, fixing three separate peer-triggered vulnerabilities touching channel closures, splicing, and on-the-fly channel funding. The flaws could be used to push local balances toward miners as fees or to strand funds during a cooperative close, splice, or funding event. Eclair underpins ACINQ's Phoenix wallet.
Core Lightning (CLN) addressed a denial-of-service path reported by developer Erick Cestari through responsible disclosure, according to Bitcoin Optech Newsletter #421. The bug, which affected versions before 25.09, allowed an attacker to exhaust a target node's memory through oversized pong responses, and the fix shipped in pull request #8525 and the 25.09 release, with a parallel 26.06.7 build for nodes on the earlier major version. On September 15, 2026, CLN maintainers separately told operators to disable experimental features while they investigated a distinct issue that could put funds at risk. That investigation remained open at the time of the supplemental reporting.
Across the disclosures, none has a confirmed dollar loss, and each bug sat in channel state, fee negotiation, or shutdown and restart logic rather than in the base cryptography. Coverage also notes the falling number of public Lightning nodes, from roughly 20,700 at the 2022 peak to an estimated 17,000 to 17,400 as of September 2026, and public channel capacity of roughly $410 million to $485 million at Bitcoin's reported price of about $86,600 on September 23, 2026. Note that these capacity figures are estimates drawn from the supplemental sources rather than from the primary article, which could not be retrieved.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.