Bitcoin Thursday — October 22, 2026
Lightning security updates, a costly wallet phishing attack, and experimental off-chain contracts.
Welcome back to Bitcoin Thursday!
Security once again dominates this week’s technical Bitcoin news. Eclair released two consecutive hardening updates, while a compromised notification provider enabled attackers to send convincing phishing messages through an official hardware-wallet companion app.
This edition covers developments published or released since October 15. Confirmed facts are separated from proposals, estimates, and ongoing investigations.
1. Eclair 0.14.5 follows an urgent security update
Eclair 0.14.5 was released on October 20, only five days after version 0.14.4.
ACINQ describes 0.14.5 as a security-hardening release and recommends upgrading because malicious Lightning nodes can exploit some of the corrected issues. The maintainers credit Nuhiat-Arefin and mptfire for responsible disclosures.
Detailed public information about the newly corrected vulnerabilities remains limited. That means operators should take the upgrade recommendation seriously without assuming unconfirmed thefts or successful exploitation.
Version 0.14.4, released on October 15, also contained extensive security hardening. Its most visible change blocks requests to Eclair’s API that contain a browser Origin header. This prevents an ordinary website from silently sending authenticated commands through a node operator’s browser after HTTP credentials have been cached.
The earlier update also hardened splicing, on-the-fly funding, onion-packet validation, closing-script updates, seed-file handling, and transaction publication.
Why it matters: Eclair operators should move to 0.14.5. Existing channels do not need to be closed: ACINQ says operators can stop Eclair, upgrade, and restart it normally. Anyone running a custom browser-based interface in front of the Eclair API must review the new browser-access restriction.
Sources: Eclair 0.14.5 release · Eclair 0.14.5 notes · Eclair 0.14.4 notes
2. Two previously fixed Eclair denial-of-service bugs are disclosed
Bitcoin Optech’s October 16 newsletter highlighted two additional denial-of-service vulnerabilities affecting Eclair 0.14.0 and earlier. Both were fixed in Eclair 0.14.1, released in July.
The first was a race condition discovered by Matt Morehouse with his smite Lightning fuzzer. By rapidly repeating the same temporary channel ID, an attacker could create orphaned channel processes that consumed memory until the node crashed.
The second vulnerability was discovered by Erick Cestari using an LLM-assisted analysis harness followed by manual confirmation and a proof of concept. It allowed an attacker to bypass Eclair’s pending-channel limit. In testing, one connection exhausted a node with 4 GB of memory in roughly 48 minutes. Because the bogus channels were stored, the node could crash again after restarting.
These are availability vulnerabilities, not reported cases of stolen bitcoin. ACINQ’s own Eclair infrastructure had already been patched before the public disclosure.
Why it matters: Operators still using 0.14.0 or older should upgrade immediately—preferably directly to the current 0.14.5 release.
Sources: Original disclosure by Erick Cestari · Bitcoin Optech Newsletter #427
3. Fake official wallet alerts lead to confirmed Bitcoin theft
On October 17, attackers hijacked access belonging to a third-party provider used to deliver notifications for NGRAVE’s LIQUID wallet app.
The attackers sent a fake security warning through the real notification channel. It directed users to a convincing copy of NGRAVE’s website, where they were asked to enter a recovery phrase or “Perfect Key.” Automated scripts then emptied affected wallets.
According to NGRAVE’s incident report, published on October 19, the company had traced approximately $2.56 million from about 70 addresses across four networks. This included about $1.77 million in bitcoin, which was divided among twelve new addresses.
NGRAVE says the hardware wallet itself and its private-key storage were not breached. The theft occurred when users entered their recovery information into the phishing site. The compromised provider access also exposed some notification, device, usage, swap, address, and approximate-location data.
These loss figures remain part of an ongoing investigation and were described by NGRAVE as a minimum rather than a final total.
What users should remember: No legitimate wallet manufacturer, app notification, support employee, or security website needs your recovery phrase. If any message asks for it, stop—even when the message appears inside an official app.
Source: NGRAVE’s official October 19 incident report
Bitcoin meme of the week
“Official app alert: enter your seed phrase!” — The answer is always no.
4. Eclair strengthens protection around splices and Lightning payments
Several changes included in Eclair 0.14.4 address situations in which a malicious channel peer might interfere with the enforcement of HTLCs during splicing.
The fixes reject splice transactions with unsuitable locktimes, relative timelocks, nonstandard witnesses, excessive weight, or an inadequate feerate. Eclair can also retry commitment and penalty transactions that initially conflict with an unconfirmed transaction.
Additional corrections protect on-the-fly funding, where liquidity is purchased as part of an incoming payment. Earlier behavior could, in special adversarial situations, leave a node paying a downstream peer without successfully collecting the corresponding incoming HTLC.
These are implementation fixes rather than changes to Bitcoin’s consensus rules.
Why it matters: The complexity of splicing and just-in-time liquidity creates new edge cases for Lightning implementations. Node operators benefit from the features only when the underlying enforcement paths remain reliable under hostile peer behavior.
Sources: Bitcoin Optech’s technical summary · Eclair PR #3396 · Eclair PR #3399
5. LN-GAP proposes complex contracts inside Lightning channels
Adam Gibson has proposed LN-GAP, an experimental protocol for running multi-round, two-party contracts within Lightning channels.
Gibson demonstrated the idea with a game of chess in which the winner receives the pot. Most interaction takes place off-chain, while disputes can be settled using a constant number of on-chain transactions.
A committee called a “venue” would attest whether signed messages were published before their deadlines. The committee would not hold the participants’ funds, but the design assumes that a majority of its members remain honest. If more than half collude with one participant, funds could be stolen.
Potential applications extend beyond games to proof-of-storage contracts and off-chain dispute systems.
Why it matters: LN-GAP is research and a prototype—not a deployed Lightning feature or proposed Bitcoin fork. It demonstrates how Lightning channels might eventually support more complex applications, while also making the trust assumptions explicit.
Sources: Adam Gibson’s original Bitcoin-Dev post · Bitcoin Optech Newsletter #427
Bitcoin Core watch
Bitcoin Core 32.0rc4 is available for testing. It remains a release candidate, not the final Bitcoin Core 32.0 release.
Production node operators should not interpret an RC announcement as a general upgrade recommendation. Developers and experienced testers can use the official testing guide and report problems before the final release.
Sources: Bitcoin Core 32.0rc4 directory · Bitcoin Core 32.0 testing guide
This week’s perspective
The common thread is trust at the boundaries.
Lightning implementations must defend themselves against malicious peers. Wallet users must distrust every request for recovery information—even one delivered through an apparently official channel. Experimental protocols must state exactly which participants must remain honest.
Which lesson matters most this week: installing security updates quickly, protecting seed phrases, or reducing trust in Bitcoin applications?
Bitcoin Thursday follows the technology behind the headlines.
There is no order without chaos!
[email protected]
Images and screenshots are from me or AI generated
Posted via HiveSuite
that notification provider breach is wild since getting a fake alert right through the official app makes falling for it so much easier
Yeah, you can't be sure nowadays. So many hacks and security breaches in the past months.
!BBH !ALIVE !SLOTH
Posted via HiveSuite
An LLM harness finding a bug that can crash a 4 GB node in about 48 minutes is kind of the real story here. Fuzzing just got cheaper for attackers too, so I wonder how many more Eclair disclosures we see before year end.