Blockstream embargos Lightning code after critical flaw
- Blockstream released a Core Lightning security patch as closed-source binaries under a two-week code embargo.
- Developers warned that compiled binaries offer no real defense because attackers can easily decompile them.
Core Lightning maintainers broke a fundamental unwritten rule of Bitcoin development.
Following a severe vulnerability alert that forced node operators to shut down, Blockstream released version 26.06.7 exclusively as compiled binaries. Maintainers placed the underlying source code under a strict two-week embargo, arguing that hiding the code would prevent malicious actors from reverse-engineering the patch against unpatched nodes.
On Ungovernable Misfits, host Q condemned the decision as a dangerous precedent that fails basic security reality. Sophisticated attackers easily decompile binaries anyway, leaving node operators running untrusted executable files without genuine protection. Technical disclosures on September 4 confirmed the bug involved a remotely triggered denial-of-service vulnerability.
"Core Lightning maintainers committed an open-source cardinal sin."
- Q, Ungovernable Misfits
The security disruption extended across rival scaling teams as well. ACINQ's Eclair team issued version 0.14.2 to address critical exploits from malicious nodes. On Ungovernable Misfits, Q highlighted that the vulnerability targeted Eclair's remote procedure call connection with the underlying Bitcoin daemon.
"Attackers easily decompile binaries anyway, leaving operators with closed-source code and no real added protection."
- Q, Ungovernable Misfits
While scaling protocols managed software bugs, researchers demonstrated base-layer resilience against far larger future threats. Starkware researchers Avihu Levy and Tom Giladi broadcast the first quantum-resistant transaction in Block 964,199 on mainnet without requiring a soft fork.
Using hash-based one-time signatures constructed from existing script opcodes, the transaction consumed 1,321 virtual bytes - five times larger than standard transfers. Higher fee burdens may limit frequent usage during congestion, but the test proves Bitcoin's script engine counters quantum threats today.
Consensus stability held firm against forced software shifts elsewhere. Developer Luke Dashjr launched Bitcoin Knots version 29.4.1, swapping SHA-256 for Blake2b to brick ASIC miners. Exchanges, mining pools, and Lightning nodes ignored the breakaway chain, cementing the network's resistance to unilateral hard forks.
Source Intelligence
- Deep dive into what was said in the episodes
The AI-Pocalypse Continues | THE BITCOIN BRIEF 88 • Sep 1
- Core Lightning maintainers issued a two week embargo on a critical vulnerability, releasing version 26.06.7 as closed source signed binaries. Q criticizes this precedent, arguing motivated attackers can easily reverse engineer binaries to target unpatched nodes anyway.
- Eclair version 0.14.2 released a critical update to address security exploits from malicious nodes. Q suggests the vulnerability likely targets Eclair's remote procedure call connection with the Bitcoin daemon.
Also discussed on this episode: (10)
Protocol (2)
- Starkware researchers Avihu Levy and Tom Giladi mined the first quantum safe Bitcoin transaction on mainnet in block 964199. Using existing script opcodes without consensus changes, the transaction is five times larger and more expensive than standard transactions.
- Luke Dashjr launched a hard fork on the Bitcoin Knots breakaway chain to swap the SHA-256 hashing algorithm for Blake2b. This change aims to eliminate the ASIC boost efficiency edge but lacks support from major exchanges or implementations.
Custody (4)
- Coinbase partnered with Better Mortgage to offer bitcoin backed mortgages, allowing borrowers to pledge digital assets as collateral and bypass taxable selling events. Q notes that borrowers must surrender custody of their keys to high interest loans.
- Kraken accounts were frozen after receiving thousands of dust transfers from wallets tied to the sanctioned exchange HTX. While user access has been restored, Kraken continues to hold millions of dollars in funds categorized as tainted.
- Sparrow Wallet version 2.5.4 introduced mandatory anti klepto protection for BitBox02 hardware wallets. The protocol prevents compromised USB signing devices from secretly leaking private keys over time through transaction signatures.
- Envoy version 2.3.3 resolved Bluetooth pairing issues with Passport Prime hardware wallets. The update specifically corrects a clock drift defect on the Passport Prime that previously degraded connection stability.
Open Source (1)
- The Human Rights Foundation distributed development funds across sixteen global open source projects. Funded initiatives include the 256 Foundation, My First Bitcoin, and privacy tools like Wallet Scrutiny and Xerox Chat.
Regulation (1)
- Peach Bitcoin paused its peer to peer escrow model due to pressure from Swiss regulators seeking to reclassify the business. Without escrow protections, non-KYC sellers are limited to one active trade, and buyers face increased risk of counterparty rug pulls.
Coding (1)
- Developer GG built a MiniScript fork of SeedSigner along with a standalone bridge tool for Liana. The bridge allows users to scan QR codes and load file based PSBTs without requiring a complete rewrite of Liana desktop software.
Media (1)
- Q launched an interactive archive search feature on the Ungovernable Network website, organizing over 500 episodes into searchable topics with timestamped links. The release includes progressive web app support suggested by Jordan and mobile full screen video optimization.