The LND Lightning Network vulnerability recently disclosed poses a significant risk to channel balances, particularly for operators running versions below 0.21.0. This flaw, involving a cooperative-close scenario, can result in an attacker wiping out the entire balance of a Lightning channel under specific conditions.
Understanding how the LND cooperative-close flaw works, which versions are affected, and what steps node operators need to take is essential for anyone running a Lightning node. This article breaks down the vulnerability, explains the technical details, and provides practical guidance on mitigating channel risks linked to this Lightning Network security patch.
How the LND Cooperative-Close Flaw Threatens Channel Funds
The LND cooperative-close flaw creates a scenario where an attacker, by manipulating the channel closing process, can steal the entire balance of a Lightning channel. This isn’t a theoretical risk: researchers demonstrated that the vulnerability allows for maximum-loss conditions if exploited exactly as described.
The attack hinges on a sequence of events. First, a malicious peer agrees to a cooperative channel close. After the closing transaction receives its first on-chain confirmation, a one-block Bitcoin chain reorganization occurs. The attacker then broadcasts a previously revoked commitment transaction—essentially, an outdated state of the channel that should be punishable by the protocol.
Before LND 0.21.0, nodes would erase their record of the channel once the closing transaction landed in a block. If that block later vanished due to a reorganization, the node lacked the necessary information to detect and punish the attacker for broadcasting the old, revoked state. This gap allowed the attacker to claim the full channel balance, while the honest node could not respond appropriately.
Although no real-world exploit has been confirmed, the risk is both real and severe. For operators with significant channel balances, this vulnerability could translate to direct financial loss if left unaddressed.
Technical Breakdown: Sequence of a Full-Balance Channel Attack
The LND Lightning Network vulnerability only triggers under a rare combination of events. Understanding the technical steps helps clarify how the exploit works and why patching is critical.
- Step 1: The attacker opens a channel and cooperates willingly in the closure process.
- Step 2: The cooperative close transaction is published to the Bitcoin blockchain and receives its first confirmation.
- Step 3: A one-block Bitcoin reorg occurs, removing the cooperative close transaction from the chain.
- Step 4: The malicious peer publishes a revoked (outdated) commitment transaction to the blockchain.
- Step 5: The vulnerable LND node, having forgotten the channel after seeing the first confirmation, fails to broadcast penalty transactions.
- Result: The attacker can claim the entire channel balance unchallenged.
This exploit requires both a cooperative peer willing to coordinate the attack and an unlikely but possible blockchain reorganization, usually within a single block. While the odds are low, the downside is total loss of channel funds—making it a high-severity risk.
Which LND Versions Are Vulnerable?
The official repository history places the fix for this Lightning node channel risk in LND version 0.21.0. Contrary to some public disclosures, 0.20.0 and earlier standard releases do not contain the fix unless independently patched by operators.
According to the project’s release notes and pull requests, the mitigation was merged into the master branch as pull request #10331 on January 16, 2026. A temporary backport to the 0.20.x branch was later reverted, and the documentation now clearly states that 0.21.0 is the first version with the full solution. This means:
| LND Version | Official Fix Included? | Action Required |
|---|---|---|
| 0.21.0 and above | Yes | No action needed (use latest release) |
| 0.20.x (standard builds) | No | Update immediately or apply independent patch |
| Below 0.20.0 | No | Update immediately |
As of August 2026, the latest official package is lnd v0.21.2-beta, which contains all necessary Lightning Network security patches. Operators still running versions below 0.21.0 should upgrade without delay to eliminate this channel balance exploit risk.
Details of the Security Patch: How LND Responds After the Fix
The Lightning Network security patch addressing the LND cooperative-close flaw changes how nodes handle channel closure and blockchain reorganizations. Previously, LND would consider a channel resolved after a single confirmation of the cooperative close transaction. The vulnerability stemmed from this premature state deletion, which left the node unable to react if that transaction was later reorganized out of the chain.
With the fix in place (beginning in version 0.21.0), LND nodes retain the channel state until the closing transaction has received multiple confirmations. This extra caution window gives the node time to react to any chain reorganizations and to detect if a revoked commitment transaction is published during that period.
LND also now listens actively for reorganization notifications. If a reorg occurs and the close transaction disappears from the chain, the node restores the channel state and is prepared to broadcast penalty transactions if an attack is attempted. This approach ensures the node can enforce punishment mechanisms integral to Lightning Network security, protecting channel funds even in edge-case scenarios.
For node operators, this means a more robust safety net: the window for possible Lightning node channel risk is dramatically reduced, and attackers can no longer exploit the premature deletion loophole.
Practical Guidance for Node Operators: Mitigating Channel Risks
Every Lightning node operator should take concrete steps to protect against the LND Lightning Network vulnerability and related channel balance exploits. If your node is running any LND version below 0.21.0 and has not been independently patched, your funds remain at risk.
Follow these best practices to ensure your node remains secure:
- Upgrade promptly: Move to LND 0.21.0 or later. The current best option is lnd v0.21.2-beta.
- Monitor channel closes: Watch for unusual channel close activity and check that your node retains close state until multiple confirmations.
- Stay updated: Subscribe to LND and Lightning Network developer mailing lists for patch announcements and vulnerability disclosures.
- Review node logs: Regularly audit logs for signs of reorganizations or revoked commitment broadcasts.
- Backup channel state: Maintain routine backups in case your node needs to respond to a reorg event or to recover from a crash.
Node operators with large channel balances should be especially vigilant. While the attack requires both a chain reorganization and a malicious peer, the financial stakes warrant proactive defense. Avoid running outdated software, and verify the status of applied patches if you maintain a custom build or package.
Comparing LND to Other Lightning Implementations
The LND cooperative-close flaw is specific to the LND implementation. There is no evidence that other major Lightning Network node software, such as c-lightning (now Core Lightning) or Eclair, share this exact vulnerability.
This highlights a broader lesson in Lightning Network security: each implementation handles channel state, closing logic, and reorg events differently. Operators should track security advisories and update policies for every node type they run.
While LND is the most widely used Lightning node software—estimated at over 70% network share as of 2026—other implementations continue to evolve their own security models. Operators running a mix of node types should apply the same diligence in patch management and monitoring for each platform.
Community vigilance and transparency in disclosure play a critical role in keeping the Lightning Network resilient to emerging threats. Even isolated flaws like this are reminders to stay current and collaborate with developers on best security practices.
Frequently Asked Questions
What is the LND Lightning Network vulnerability?
The LND Lightning Network vulnerability refers to a flaw in certain versions of LND where a malicious peer can steal the entire channel balance during a cooperative close if a Bitcoin blockchain reorganization occurs. The exploit takes advantage of the node forgetting the channel state after just one block confirmation, allowing an attacker to broadcast a revoked commitment transaction without penalty.
Which LND versions are affected by the channel wipeout risk?
All standard LND releases below version 0.21.0 are affected by this vulnerability unless they have been independently patched. The official fix, including robust reorg handling, is present starting from LND 0.21.0. Operators should update immediately if they are running 0.20.x or earlier.
How can I tell if my node is vulnerable?
If your LND node is below 0.21.0 and you haven’t applied an independent patch for the cooperative-close flaw, your node is at risk. Check your software version with the command lnd –version or through your node dashboard. Upgrade to the latest release to secure your funds.
Was this LND vulnerability exploited in the wild?
So far, there are no confirmed cases of this vulnerability being exploited against live users. The risk was identified and disclosed before any real-world attacks were reported. However, the technical conditions for exploitation are achievable, so patching remains urgent.
Does the vulnerability affect other Lightning node implementations?
No, the cooperative-close flaw described in the LND vulnerability is specific to LND. There is no current evidence that similar flaws exist in other major Lightning node software such as Core Lightning or Eclair. Still, all operators should monitor their own implementations for similar risks.
Conclusion
The LND Lightning Network vulnerability exposes a serious channel wipeout risk for operators on versions before 0.21.0. Accurate information about patch versions and attack scenarios is essential for maintaining Lightning node security. If you run an LND node, check your version, review your patch status, and upgrade to the latest release without delay. Protect your channel funds, stay informed about future updates, and contribute to a more secure Bitcoin Lightning ecosystem.
For more technical details and release notes, visit the official LND GitHub repository and subscribe to network security bulletins.