{"id":13791,"date":"2026-09-27T23:34:40","date_gmt":"2026-09-27T23:34:40","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13791"},"modified":"2026-09-27T23:34:40","modified_gmt":"2026-09-27T23:34:40","slug":"core-lightning-patches-revoked-channel-penalty-flaw","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13791","title":{"rendered":"Core Lightning patches revoked-channel penalty flaw"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>Core Lightning, a Lightning Network node implementation, fixed a channel-close flaw in v26.06.7 that could let a peer broadcast an old, revoked channel state without triggering the penalty for cheating. Bitcoin Optech&#8217;s Sept. 25 explanation of the now-public patch makes the risk concrete for operators still running older builds.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Onslaught of AI-found bugs forces Bitcoin&#8217;s Core Lightning into a secret 14-day emergency lockdown<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>Lightning peers replace earlier channel commitments as balances change. If one broadcasts a revoked commitment, the counterparty should be able to claim a penalty. Before the fix, Core Lightning could instead treat that funding spend as a cooperative close when its outputs matched shutdown scripts already on record.<\/p>\n<p>That depended on a specific channel setup. A peer that had not specified an upfront shutdown script when the channel opened could later name the output script of its revoked commitment in a shutdown message. It could then abandon the cooperative close and broadcast the old commitment. Matching the outputs alone made the transaction look legitimate, bypassing the penalty path, according to the maintainers&#8217; patch notes and regression test.<\/p>\n<p><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-566320 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress.jpg\" alt=\"Flow diagram of a Core Lightning revoked commitment misclassified as a mutual close, and the v26.06.7 locktime-and-sequence fix\" width=\"1122\" height=\"1402\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress.jpg 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress-240x300.jpg 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress-819x1024.jpg 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress-768x960.jpg 768w\" sizes=\"auto, (max-width: 1122px) 100vw, 1122px\"\/><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter wp-image-566320 size-full\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress.jpg\" alt=\"Flow diagram of a Core Lightning revoked commitment misclassified as a mutual close, and the v26.06.7 locktime-and-sequence fix\" width=\"1122\" height=\"1402\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress.jpg 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress-240x300.jpg 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress-819x1024.jpg 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-41e890af-cd00-41e6-b95f-7c2678c9c999-wordpress-768x960.jpg 768w\" data-sizes=\"(max-width: 1122px) 100vw, 1122px\"\/><\/p>\n<p>The repair checks a transaction&#8217;s locktime and sequence encoding to recognize a commitment before looking at its outputs as a possible mutual close. The materials describe a potential way to evade the penalty, not a confirmed theft. This is a Core Lightning channel-handling issue, not a change to Bitcoin&#8217;s base-chain rules.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining The Catalyst\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Catalyst <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">What\u2019s moving crypto. Why it matters.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Get CryptoSlate\u2019s essential stories and what to watch next.<\/p>\n<p>  <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"16\" fill=\"currentColor\" viewbox=\"0 0 16 16\" aria-hidden=\"true\" focusable=\"false\"> <path d=\"M15 3.604H1v1.891h14v-1.89ZM1 7.208V16l7-3.926L15 16V7.208zM15 0H1v1.89h14z\"\/> <\/svg> <span>Published on Substack<\/span> <\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Seven days a week. Unsubscribe anytime.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<div class=\"cs-inline-newsletter__success\" role=\"status\" aria-live=\"polite\" aria-atomic=\"true\" tabindex=\"-1\"> <span class=\"cs-inline-newsletter__success-icon\" aria-hidden=\"true\"\/><\/p>\n<div>\n<h3 class=\"cs-inline-newsletter__success-title\">Check your inbox.<\/h3>\n<p class=\"cs-inline-newsletter__success-copy\">Your signup request was sent. If confirmation is required, follow the email from Substack.<\/p>\n<p class=\"cs-inline-newsletter__success-hint\">Look in spam or promotions if you don\u2019t see it.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/aside>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">How a quiet flaw in Bitcoin\u2019s top scaling network left user funds open to total wipeouts \u2013 and the fix arrived later than disclosed<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<h2>What operators should check<\/h2>\n<p>A Core Lightning build older than the fixed v26.06.7 release needs an update. The project strongly recommends v26.06.8, a later security release with additional fixes. The revoked-close path requires the shutdown-script condition above, so a vulnerable software version does not mean every channel could be exploited that way.<\/p>\n<p>Operators who used Docker images during the earlier rollout should also verify the image digest. The project&#8217;s v26.06.7 release notes say that images served under v26.06.7 and related tags from Aug. 28 to Sept. 1 reported the new version on startup but lacked its fixes. The project lists the corrected digests and instructs users with a mismatch to re-pull the image.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The version history separates the two patches. Core Lightning shipped v26.06.7 on Aug. 28, then published its initially embargoed release source code on Sept. 11. Pull request 9509, merged into the main development branch Sept. 15, carried those changes forward. V26.06.8 followed Sept. 22 with other security fixes and immediately available source, though a few tests remained withheld. Optech&#8217;s Sept. 25 report explained the already-shipped revoked-close repair.<\/p>\n<\/div>\n<p>Featured,Lightning,Bitcoin,BTCBitcoin,BTC#Core #Lightning #patches #revokedchannel #penalty #flaw1790552080<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Core Lightning, a Lightning Network node implementation, fixed a channel-close flaw in v26.06.7 that could let a peer broadcast an old, revoked channel state without triggering the penalty for cheating. Bitcoin Optech&#8217;s Sept. 25 explanation of the now-public patch makes the risk concrete for operators still running older builds. Related Reading Onslaught of AI-found bugs<\/p>\n","protected":false},"author":1,"featured_media":13792,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,285,1362,382,2661,4426,1916,7163],"class_list":["post-13791","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-btc","tag-core","tag-flaw","tag-lightning","tag-patches","tag-penalty","tag-revokedchannel"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Core Lightning patches revoked-channel penalty flaw - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Core Lightning fixed a flaw that could let a revoked state evade penalty. Operators on older builds and affected Docker images should update.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=13791\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Core Lightning patches revoked-channel penalty flaw\" \/>\n<meta property=\"og:description\" content=\"Core Lightning fixed a flaw that could let a revoked state evade penalty. Operators on older builds and affected Docker images should update.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=13791\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-27T23:34:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13791\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=13791\",\"name\":\"Core Lightning patches revoked-channel penalty flaw - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13791#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13791#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp\",\"datePublished\":\"2026-09-27T23:34:40+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Core Lightning fixed a flaw that could let a revoked state evade penalty. Operators on older builds and affected Docker images should update.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13791#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=13791\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13791#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=13791#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Core Lightning patches revoked-channel penalty flaw\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Core Lightning patches revoked-channel penalty flaw - Crypto News: Latest Cryptocurrency News and Analysis","description":"Core Lightning fixed a flaw that could let a revoked state evade penalty. Operators on older builds and affected Docker images should update.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=13791","og_locale":"en_US","og_type":"article","og_title":"Core Lightning patches revoked-channel penalty flaw","og_description":"Core Lightning fixed a flaw that could let a revoked state evade penalty. Operators on older builds and affected Docker images should update.","og_url":"https:\/\/cryptonews.uk.com\/?p=13791","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-27T23:34:40+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=13791","url":"https:\/\/cryptonews.uk.com\/?p=13791","name":"Core Lightning patches revoked-channel penalty flaw - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=13791#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=13791#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp","datePublished":"2026-09-27T23:34:40+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Core Lightning fixed a flaw that could let a revoked state evade penalty. Operators on older builds and affected Docker images should update.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=13791#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=13791"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=13791#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/core-lightning-security-bridge.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=13791#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Core Lightning patches revoked-channel penalty flaw"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13791"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/13791\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/13792"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}