The Warning That Shook Crypto

On Wednesday, Core Lightning maintainers dropped a bombshell: several critical vulnerabilities had been found in CLN, Blockstream’s flagship Lightning implementation. The discovery didn’t come from a team of elite security researchers or a well-funded audit firm. It came from artificial intelligence. And the response was unlike anything we’ve seen in Bitcoin’s history.

Developers aren’t asking node operators to patch and move on. They’re telling them to shut everything down. Immediately.

“Critical vulnerability in Core Lightning,” software developer Calle wrote on X. “Blockstream developers urge users to shut down CLN Lightning nodes right NOW!”

Here’s the catch that makes this story truly unsettling: the patched version hasn’t been released yet. Node operators running CLN version 26.04 or earlier are sitting on a ticking time bomb, and their only option right now is to go offline. No fix. No workaround. Just pull the plug and wait.

AI’s Growing Role in Finding and Exploiting Flaws

This didn’t happen in a vacuum. Over a ten-day period in August, Core Lightning developers were flooded with AI-generated CVE reports. CVE stands for Common Vulnerabilities and Exposures, the industry-standard way researchers flag software flaws. But these weren’t human researchers typing up their findings after weeks of painstaking analysis. These were AI tools scanning codebases at machine speed, spitting out vulnerability reports faster than any human team could process.

And here’s the really interesting part: many of those AI-generated reports turned out to be legitimate.

“Receiving a burst of them, especially ones generated by AI tools rather than human researchers, apparently surfaced real exploitable issues,” analysts noted.

In my experience covering cybersecurity in crypto, this is a paradigm shift we haven’t fully processed yet. AI isn’t just helping attackers find vulnerabilities anymore. It’s finding them faster than defenders can patch them. And in this case, the AI found them before the humans did.

The Two-Week Embargo and What It Means

Core Lightning’s team is preparing signed binaries with the fixes and hopes to have them out within 48 hours. But here’s where it gets strategically fascinating: the team has placed a two-week embargo on disclosing the technical details of the vulnerabilities.

Why? Because if they publish the details before everyone has patched, attackers could reverse-engineer the fix and weaponize the information. It’s a calculated risk, keeping the public in the dark to protect them from themselves.

Christian Decker, a long-time Core Lightning contributor, explained that the team will release ready-to-run binaries while keeping the source code patches private for 14 days. Previous releases, including version 26.04, will no longer receive support during this response.

The Bigger Picture: Lightning Under Siege

This isn’t an isolated incident. The CLN vulnerability disclosure comes on the heels of several other major security events that have rattled Bitcoin’s infrastructure.

Just weeks earlier, the Coldcard firmware exploit, which caused losses of nearly 2,000 BTC, worth roughly $114 million, was also believed to have been discovered by AI. Then there’s Boltz, a Lightning, Liquid, and onchain swapping platform that shut down all its swap services on August 3 after months of AI-assisted attacks. That shutdown impacted other platforms including Aqua and Zeus.

And if that wasn’t enough, on the same day CLN issued its advisory, a separate vulnerability disclosure surfaced for LND, the competing Lightning implementation developed by Lightning Labs. Both major Lightning implementations facing security disclosures simultaneously? That puts the entire network’s resilience into serious question.

A Network in Decline

The timing couldn’t be worse. The Lightning Network’s capacity has been hemorrhaging value. As of Wednesday, the network’s capacity stood at 3,998 BTC, valued at roughly $313.5 million. That’s down from 5,891 BTC on December 27, 2025, a decline of 1,893 BTC, or 32.1%, in about eight months.

Public channel balances have been sliding since May 30, and the decline accelerated dramatically after December. Now, with both major Lightning implementations facing security crises simultaneously, we could see even more liquidity flee the network.

“Wtf is happening. This is really scary,” wrote Cobra Bitcoin, the pseudonymous owner of bitcoin.org.

I think that sentiment captures the mood perfectly. When the people building Bitcoin’s infrastructure are telling everyone to turn off their nodes and wait, it’s worth paying attention.

What This Means for the Future

The CLN vulnerabilities haven’t been linked to any confirmed thefts or active exploits in the wild, at least not yet. But the fact that they exist, and that AI found them, raises uncomfortable questions.

Is the industry ready for a future where AI can find vulnerabilities faster than humans can fix them? Are we prepared for AI-assisted attacks that exploit flaws we didn’t even know existed? And what happens when the AI isn’t just finding the vulnerabilities but actively exploiting them?

The CLN team is working furiously to get those signed binaries out. In the meantime, they’ve recommended that nodes restart with the --offline flag, which stops peer connections while preserving local channel state. It’s not ideal, but it’s the only option until the fix arrives.

Summary

Core Lightning, Blockstream’s implementation of Bitcoin’s Lightning Network, has uncovered multiple critical vulnerabilities discovered through AI-generated CVE reports. Node operators running version 26.04 or earlier have been urged to shut down immediately, with no patched version yet available. The team is preparing signed binaries with a target of 48 hours for release, followed by a two-week embargo on technical details. The discovery follows a pattern of AI-assisted security incidents, including the Coldcard firmware exploit that caused nearly 2,000 BTC in losses and the shutdown of Boltz after months of AI attacks. With Lightning Network capacity down 32.1% from its December 2025 peak and both major implementations facing simultaneous security disclosures, the incident raises critical questions about the resilience of Bitcoin’s second-layer infrastructure in an era of AI-driven security threats.