Not sure if this has been shared here, in any case, for those running it, this is a must read.



https://x.com/callebtc/status/2092683963366064550

This @callebtc is part of the Bitcon Red Team that come into fruition after the Cordcard hack. And he is a heading a major security audit of the Bitcoin ecosystem and reporting those vulnerabilities that they have found.

Core Lightning will release a new update soon. They suggest that all users update their software to the latest release after verifying the signature of the binaries. Those who don't want to or can't do it for some reason, should take their nodes offline. They don't recommend shutting nodes down. When they are offline, nodes won't have connections to other peers and can't route payments.

They aren't saying what's been discovered but it's safe to assume that it's significant. They will only release details to the public after a two-weeks waiting period. I guess the idea is to give users enough time to upgrade without the vulnerabilities being publicly available knowledge that can be further abused against the users.

There are no much details in this warning for us to judge how serious the vulnerability is, that's what I think. However, that's not a reason to not take the warning serious. Running LN noded comes with the responsibility of keeping it maintained, I'm surprised that not much is been said about the development. Waiting until the technical details are public may be too late.

Using artificial intelligence to identify vulnerabilities is becoming widely used. The Bitcoin Red Team is doing a good job of identifying these potential attacks and issuing notices. After the ColdCard incident, the team discovered 85 critical and 635 high-severity issues across different open-source projects.


I don't see the news in most crypto news outlets that I am subscribed to. Maybe it's not too serious or people have not lost so much money because of the vulnerability. The news would have gone viral if people have lost substantial amounts.

I'm not surprised no one is paying much attention to the news, and the reason is that people hardly use the internet. The comment on X isn't helping at all either. 

They call it AI attacks, and it's gonna increase as it has been found that the lighting network has more vulnerabilities than was generally known.

Drifting a bit OT but like many things it depends on your use case.

You are not giving up sovereignty if you are running your own LN node, which for the most part with the nodes in a box so to speak is not difficult.

For small amounts of money it's great, no waiting, no fuss, just scan a QR code and they have their sats just about instantly.
More privacy since it's just about impossible to trace a lightning TX.


If you don't mind giving up privacy with LNURL and Lightning Address you can do a lot of things.
For real amounts of BTC it's a different story. But for $1.00 of BTC it's much easier to say send it to somename@somedomain.com

-Dave

It's also because with Coldcard you had drama, hundreds and thousands affected, a ton of material to write about, you had the company to balme , the thiefs, the victims , endless podcast material. With this, you have a vulnerability with not yet a single confirmed victim.
Nobody is making an article about a truck that was about to crash but barely avoided it.  


Where is that, Antarctica? Oh wait, everyone there uses the internet!

Just like I predicted, and this is going to happen much more in future.
More people now have access to different AI tools, and they are using them to find and exploit bugs in different projects.
I would not keep anything in lightning network and big losses to happen soon in LN space.

This wouldn't be much of a concern, since almost nobody uses the Lightning Network. The vast majority of people are using on-chain Bitcoin. At least, AI is being put to good use by helping detect vulnerabilities before they're exploited. On the bright side, this makes the Lightning Network stronger and more resilient.

I have noted a surge in vulnerabilities, ever since AI became a thing. Who knows what else is at risk? Other sidechains, maybe? Even the BitBox02 hardware wallet was affected. Anyhow, it's a good thing Blockstream addressed the issue promptly. It could've been worse, right?