A breach in Bitcoin Bitcoin Lightning Network could send all of the node's funds directly to crypto miner

Summary: Eclair has three vulnerabilities that could lead to financial losses

Bitcoin Lightning Network technology company ACINQ released version 0.14.3 of Eclair on September 14, which fixes three security vulnerabilities that can be triggered by peer nodes. These vulnerabilities may cause node operators to lose or lock funds during collaborative shutdowns, splicing and in-the-money deposits.

According to Bitcoin Optech, 0.14.3 is a security release that mainly addresses three categories of vulnerabilities involving channel closure, splicing and instant injection.

The most direct route to attack: the cost trap of shutting down channels

The most harmful type of attack occurs in a collaborative shutdown scenario. When Eclair is responsible for paying the closure fee, malicious peer nodes can come up with an offer to charge more than the victim's local balance, which may be accepted by Eclair's underlying negotiation mechanism. As a result, the operator's output is eliminated and the entire local balance is essentially paid as transaction fees to Bitcoin crypto miner .

The patched version rejects requests for closure fees that exceed the upper limit set by operators, blocking such attacks at source.

Leakage of funds and risks in case of incomplete splicing

The second type of defect occurs when the splicing process is not completed. Splicing refers to a transaction that changes its funding without closing the channel. If Eclair finishes signing first and the other party withholds his signature, then the latest status for the channel may depend on a transaition which cannot be broadcast by the victim.

This situation also creates the conditions for stealing on-the-go payments: an attacker can make a relayed payment's entry side expire, broadcast its old channel state, and then use the payment key to withdraw funds from the account. The new version of Eclair now uses updated status supported by full signature fund transactions to force closures, eliminating this latent danger.

Problems with the Instant Funds feature and new upper limits on fees

The third vulnerability affects Eclair's Instant Deposit feature, which allows nodes to open new channels at the same time as forwarding payments. Malicious wallets can manipulate payment expiration timelines, withdrawing funds from accounts on on-chain simultaneously when deposits expire, leaving Chinese heirs solely liable for losses.

After the fix, Eclair checks relay fees and expiry buffers before submitting funds. In addition, this update also increases the default cap of 50 cents per byte for automatically estimated channel openings and splicing fees to reduce risk exposure from external expense data anomalies.

Bitcoin Lightning Network Ecological overall safety pressure increases

As soon as ACINQ released the fix, other Bitcoin Lightning Network operators were facing separate attempts to attack exposed infrastructure.

Earlier this month, Bitcoin payment processor BTCPay server said it had observed that the robot program repeatedly detected those administrators who manually re-opened LND external access to server . LND is another implementation of Bitcoin Lightning Network . The attackers targeted a password modification endpoint which did not require authentication and attempted to get their hands on the temporary window in which the LND wallet was locked.

BTCPay's response included the introduction of a separate password for LND wallets, and blocking unverified wallet management routes at the network edge while advising operators not to manually expose API interfaces on LND.

The two incidents show that the Bitcoin ecosystem is facing increasing security pressures as attackers continue to search for vulnerabilities in software which can be used to steal or transfer funds.