Core Lightning Tells Node Operators to Go Offline, Not Shut Down Amid Bug Patch

MakeCryippreferred on

Core Lightning has confirmed real security flaws among a wave of AI-generated vulnerability reports it received over the past ten days, and it is telling node operators not to shut their nodes down while a fix is prepared, according to the team’s official post on August 14.

Instead, the team’s official guidance is to restart with the offline flag. That setting blocks payments from routing in, out, or through the node, but keeps the daemon running so it can still watch the chain and react if a channel partner force-closes. A fully powered-off node cannot do that. On Umbrel and Start9, offline is a startup setting rather than a dashboard toggle, and operators on those platforms need to set it before restarting.

A two-week embargo before the fixes go public

Core Lightning plans to publish signed binaries within the next few days. Full technical details, including which CVEs were real, stay embargoed for two weeks after that, so attackers cannot reverse-engineer the flaws before most operators have patched. Every release before this one, including 26.04, is now unsupported. The team says its already-planned 26.09 release is still on track for late September.

As of this writing, Core Lightning has reported no confirmed exploitation or fund loss tied to these specific vulnerabilities. The project’s current stable release, per its GitHub repository, is v26.06.6. Pausing operations rather than pushing an unverified fix live is not unique to Core Lightning either; MANTRA halted its network earlier this year the moment it confirmed an attacker had exploited an upstream vulnerability, rather than let the chain keep running while the extent of the flaw was still unclear.

Why offline, not off: BTCPay Server’s recent drain

That distinction between offline and off is not routine caution. On August 7, BTCPay Server disclosed a critical bug in its own security advisory that was already being actively exploited, urging users to update to version 2.4.2 or shut down. Hardware wallet maker Foundation and Bitcoin publication Citadel21 both confirmed their Lightning nodes were swept during that incident. BTCPay founder Nicolas Dorier said the flaw was only caught after a developer personally lost funds tracing it, not by any automated scan.

Core Lightning’s own justification for offline, a node that keeps watching the chain and can still respond to a force-close, addresses exactly the failure mode operators hit three weeks earlier: a node that goes fully dark cannot defend a channel if a counterparty tries to force it closed. Core Lightning has not named BTCPay Server, but the guidance reads as a team that watched what happened to a neighboring project and adjusted its own advice accordingly. The stakes of getting that response wrong are already on record elsewhere in crypto this year: BounceBit’s own shutdown came only after an exploit had already drained a quarter of BB’s circulating supply, a reminder of how fast an unpatched flaw can turn into an unrecoverable loss once it is actively being used.

Operators should watch Core Lightning’s own channel for the signed binaries, verify signatures before installing, and remove the –offline flag once they have upgraded.