Bitcoin Thursday — October 15, 2026
Lightning security updates, a theft investigation, and new research into Bitcoin privacy.
Welcome back to Bitcoin Thursday!
Security is the main theme this week. Several important updates were highlighted in Bitcoin Optech’s October 9 newsletter, alongside new research into private Bitcoin transfers.
Some releases predate this reporting week. Their original dates are included below so that newly highlighted information is not mistaken for a brand-new incident.
1. Core Lightning 26.06.9 brings more security fixes
Core Lightning 26.06.9, released on October 7, contains fixes involving channel reconnection, splicing, payment handling, access controls, and remote crashes.
It also fixes a regression introduced in 26.06.8: busy nodes could incorrectly throttle peers for ordinary gossip, pings, and onion messages, delaying channel traffic.
The maintainers strongly recommend upgrading. They have temporarily withheld some security tests to make it harder to turn the published fixes into working exploits while operators update.
The release credits the Bitcoin Red Team, Project Loupe, Matt Morehouse, and other researchers and contributors.
Why it matters: Operators who installed 26.06.8 should review this newer release too. Updating can address both security problems and the traffic-throttling regression.
Source: Core Lightning 26.06.9 — official release and operator notes
2. LDK fixes vulnerabilities that could put funds at risk
Bitcoin Optech’s October 9 issue highlighted security updates for the LDK 0.2 and 0.1 branches.
The official 0.2.7 release notes describe vulnerabilities involving a malicious channel counterparty and an LSPS2 client, alongside denial-of-service fixes.
One issue involved a peer reconnecting and falsely claiming it had not received a channel update it had already acknowledged. Another involved an LSPS2 payment requesting more outgoing value than the incoming payment supplied.
Project Loupe and Nishant Bansal independently reported the channel-reconnection issue.
Why it matters: LDK is a toolkit used inside wallets and services. Users normally receive its fixes through updates to those applications. Developers should review the security releases and check which branch their application uses.
These disclosures describe potential exploits; they do not establish that every affected application has suffered a theft.
Sources: LDK 0.2.7 release notes · LDK 0.1.13
3. BTCPay Server hardens connections and permissions
BTCPay Server 2.4.5, released on October 6 and highlighted the following week, tightens several security controls.
Outbound HTTP requests now block private-network destinations by default to reduce server-side request forgery risks. This affects connections used by Lightning services, LNURL, invoice notifications, and webhooks.
The release also tightens refund permissions and access to invoice information.
Why it matters: Administrators should review the deployment notes before upgrading. Installations that intentionally connect to private services may need explicit exceptions. The accompanying Docker changes also make Tor opt-in, including for existing deployments.
Sources: Official release notes · BTCPay’s deployment explanation
4. Blink publishes a new investigation into stolen bitcoin
On October 8, the Blink team published a follow-up to its September 19 attack.
According to Blink, the original incident involved approximately 6.61 BTC taken from 24 accounts, and affected customers were reimbursed.
The new publication focuses on tracking the stolen funds through public transactions and Lightning-related activity. Blink distinguishes between evidence it considers proven, traced, probable, or involving third parties.
Why it matters: This is a new investigation update about an older theft. The labels are important: receiving a transaction or appearing near suspicious activity does not, by itself, establish wrongdoing.
Blink’s report also illustrates the tension between financial privacy and investigating stolen funds—a question worth discussing carefully.
Source: Blink — Phase two: following the coins in public
5. Shielded Bitcoin explores private transfers
Bitcoin Optech’s October 9 issue highlighted Shielded Bitcoin, a research proposal by Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin.
The proposal aims to hide transfer amounts and counterparties through encrypted records and cryptographic proofs, using Bitcoin to publish and order the data.
The original discussion began on September 24. It is research rather than a deployed Bitcoin upgrade. Entry and exit mechanisms were still identified as work for a companion paper in the reviewed material.
Why it matters: Financial privacy remains an active area of Bitcoin research. The practical questions include fees, recovery, data requirements, and the assumptions required to enter and leave the system.
Sources: Original Shielded Bitcoin discussion · Bitcoin Optech Newsletter #426
Bitcoin meme of the week
I just want to pay for coffee—not publish my financial autobiography.
What I’m watching next
Security updates deserve attention now, while privacy proposals need continued testing and review.
For Bitcoin Core, the October 9 technical roundup listed 32.0rc3 as a release candidate. A planned release date should never be treated as confirmation that the final version has shipped.
Source: Bitcoin Core 32.0rc3 — official download directory
Which development matters most to you: stronger Lightning security, better payment privacy, or easier self-hosted Bitcoin payments?
Bitcoin Thursday follows the technology behind the headlines.
There is no order without chaos!
[email protected]
Images and screenshots are from me or AI generated
Posted via HiveSuite
Withholding those tests in the Core Lightning release seems like a smart way to give operators a head start on patching. It is always a relief to see these security updates getting ahead of potential exploits.