Core Lightning has told node operators to temporarily stop routing payments. In a Discord message posted Sunday, maintainers said operators should restart with the offline flag unless they upgrade to a release that has not yet been published. The warning drew broader attention on Wednesday through a repost on stacker.news.
Details of what the fix addresses will stay under embargo for two weeks. The Discord message said the team has been validating AI-generated CVE reports coming from multiple sources and plans to publish binaries containing fixes for many of the reported vulnerabilities before releasing the source code. According to the message, those binaries will include maintainer signatures confirming reproducibility.
Older releases lose support while 26.09 stays on schedule
Support for previous releases has been withdrawn, including version 26.04. At the same time, the scheduled 26.09 release is still planned for late September. The Core Lightning team later confirmed the development in a post on X.
What offline mode changes for node operators
When a node starts with the offline flag, it drops peer connections. That means no payment routes can go into the node, out of it, or through it. The daemon still watches the chain, however, and it can respond if a channel counterparty force-closes.
That is also why the project did not tell operators to power down entirely. A switched-off node cannot defend its channels.
Calle used stronger language than the project itself
Calle, the pseudonymous developer behind the Cashu ecash protocol, amplified the warning on X with a sharper message. He told users to shut nodes down immediately and described the matter as a critical vulnerability. Core Lightning's own message did not use that wording.
Fourth Bitcoin infrastructure alert in four weeks
The Core Lightning warning marks the fourth Bitcoin infrastructure alarm in as many weeks.
- A 2021 Coldcard firmware bug that routed seed generation to a weak software randomizer has drained about $114 million in BTC since July 30.
- Swap bridge Boltz halted service indefinitely on Aug. 3, citing AI-assisted attacks.
- BTCPay Server told merchants on Aug. 7 to update or shut down because of an actively exploited flaw.
The common thread across these cases is AI-accelerated bug discovery. Earlier this month, the group referred to as the Bitcoin Red Team, led by Calle, reported 85 critical vulnerabilities across 390 projects.