A new study of Bitcoin’s Lightning Network has uncovered an uncomfortable truth about the layer-two payment system: public security warnings barely move the needle. Nearly three-quarters of Lightning nodes flagged as exposed in an August security disclosure were still running affected software two months later — even though the fixes had been available for well over a year.
The research, published on October 21 by Saurabh Kumar of Bitcoin Data Labs, examined 814 daily snapshots of Lightning’s public network graph. It found that 71% of a group of 550 public LND nodes flagged during an August 11 security disclosure were still operating on affected software release lines as of October 13. Only about 10% had upgraded during that window, while 108 nodes simply stopped appearing as live.
A year-old fix that most never installed
The most striking detail is timing. Patches for the six vulnerabilities covered by the August disclosures had been available since LND version 0.19.0 — released 446 days before the public warning. In other words, the software fix existed for roughly fourteen and a half months before most affected operators got around to installing it, and most still haven’t.
LND is one of the main software implementations used to run nodes on the Lightning Network, Bitcoin’s payment channel layer that processes transactions off the main blockchain. When a Lightning node runs outdated software, it isn’t just the operator’s funds at stake — routing failures and forced-close incidents can ripple through channels and affect counterparties who did everything right.
Warnings don’t work — platform releases do
The study’s second finding may be its most useful: what actually drives upgrades is not security advisories but convenience. The network’s largest software upgrade waves closely followed releases from Umbrel, a platform that packages Bitcoin node software into consumer-friendly boxes. The three biggest waves involved between 262 and 385 nodes each, and at least 87% of participating nodes broadcast updated software features within 48 hours of an Umbrel release.
But that convenience adds its own delay. Umbrel distributed those versions between 19 and 41 days after the corresponding LND releases, inserting an extra month or more between a fix being published and it reaching operators who depend on packaged distributions.
Public vulnerability disclosures fared far worse. Across nine LND vulnerability disclosures, the researcher found no statistically detectable acceleration in nodes moving away from affected software lines after warnings went out. The disclosures weren’t followed by upgrade surges — they were, for the most part, ignored.
The rest of the network isn’t much faster
The lag isn’t limited to security patches. Nodes running older software when LND versions 0.19 through 0.21 became available took an estimated median of 88 days to migrate to newer release lines. That’s three months of median delay for routine upgrades — the kind of operational sluggishness that would get an exchange’s security team fired.
There is one genuinely reassuring number in the data. At the time of the August disclosure, affected release lines accounted for 14.9% of live LND nodes but only 6.4% of their channel capacity, excluding an identified managed fleet. The nodes dragging their feet on patches control a relatively small share of the network’s payment liquidity. The big money, it seems, patches faster.
Caveats worth knowing
The methodology has honest limits. The study inferred release lines from advertised software features in the public network graph, which cannot identify exact patch versions. A node that upgrades without broadcasting a new announcement may still appear exposed, meaning real patch rates could be somewhat better than measured. And actual exploitability always depends on the specific vulnerability and the node’s configuration — running affected software is a risk factor, not a guarantee of compromise.
To its credit, the research team published the code and aggregate data alongside the preprint, allowing anyone to verify or challenge the findings.
What this means for Bitcoin users
For everyday Bitcoin users, Lightning’s patch lethargy matters because the network’s security assumptions depend on its operators staying current. Every month of delay is a window in which a known, documented vulnerability is live on public infrastructure. The study leaves developers and platform distributors with an unresolved question: how to shrink the weeks or months between a fix shipping and it actually running across the network.
The answer suggested by the data is unglamorous but clear. Security warnings alone don’t change behavior; distribution pipelines do. The projects that fold rapid patch delivery into the platforms people actually use will fix this problem. The ones that keep relying on operators to read advisories will keep reading studies like this one.
71 percent of flagged nodes still exposed two months later, with fixes available for over a year. everyone preaches self custody responsibility until its update day apparently
446 days the patch existed and 71% still ran affected LND. and these are the people we trust to route payments lol
The 108 nodes that went dark are the interesting part of the Kumar study. Quiet upgrades, or someone pulling the plug on boxes they no longer trusted?
worth noting the study only sees the public graph. unlisted channels would hide an upgrade from those snapshots entirely
true, but the public graph is still the routing backbone. if 71 percent of visible lnd nodes sat exposed for 446 days, the private picture is probably not better
the wildest part is the fix that actually landed traveled through umbrel, 19 to 41 days late. convenience ships security, advisories dont
The 108 nodes that just went dark are the interesting number. Some probably upgraded behind Tor or closed channels, but I bet a few were drained quietly.
^ this. nobody publishes post-mortems on lightning node losses, the incentive is to stay quiet
108 going dark is the number i keep coming back to. even if half just moved behind tor, the other half is a loss report nobody will ever file
The number nobody quotes from the Kumar study is the 87 percent upgrade rate within 48 hours of an Umbrel release. Package managers are the real patch pipeline for Lightning now, advisories are decoration.
the patch shipped with lnd 0.19.0, 446 days before the august disclosure, and 71 percent still did nothing. security is a chore and chores lose to uptime every time
446 days of patch availability and a public disclosure still only moved 10 percent. your routing counterparty did everything right and still eats the forced close, thats the part that stings
Only 10% upgraded in two months after a public disclosure. Makes you wonder what the numbers look like for the stuff nobody writes a report about.