Eclair

ACINQ has patched three peer-triggered flaws in its Eclair Lightning Network software that could have let malicious counterparties siphon a node operator’s entire local channel balance straight into a Bitcoin transaction fee. The bugs, fixed in Eclair 0.14.3 on September 14, matter to institutional Lightning operators because they show fund-loss risk can hide in routine channel operations, not just in exotic attack scenarios.

• ACINQ released Eclair 0.14.3 on September 14, 2026, patching three separate peer-triggered vulnerabilities.
• The worst flaw let an adversarial peer propose a closing fee larger than the victim’s local balance, sending the entire balance to miners.
• Eclair now caps automatically estimated channel-opening and splice fees at 50 satoshis per vByte by default.

• 0.14.3 Eclair release version that patched all three flaws
• 3 distinct peer-triggered vulnerabilities fixed in one update
• 50 sat/vB new default ceiling on automatically estimated fees

ACINQ, the Bitcoin technology firm behind Eclair and the Phoenix Wallet, said the vulnerabilities could be exploited by malicious nodes during channel closures, splicing and on-the-fly funding, and it strongly recommended operators upgrade, according to reporting from CryptoSlate. The most severe of the three centered on cooperative channel closures, where Eclair was responsible for setting the closing fee.

Malicious Peer Could Route an Entire Balance to Miners

In the flawed version, an adversarial peer could propose a closing fee larger than the victim’s actual local channel balance. Eclair’s fallback fee-negotiation logic could accept that proposal, wiping out the operator’s output entirely and effectively converting the whole balance into a transaction fee collected by Bitcoin miners rather than returned to the node.

The patch closes that gap by rejecting any closing-fee proposal that exceeds an operator’s own configured maximum. Bitcoin Optech flagged 0.14.3 as a security release addressing closing, splicing and on-the-fly funding issues.

Splicing and On-the-Fly Funding Carried Separate Fund-Loss Paths

A second flaw could strand funds mid-splice, the process of resizing a channel’s underlying funding transaction without closing it. If Eclair signed its half of a splice first and the peer withheld its own signature, the node’s latest channel state could depend on a transaction the victim had no way to publish.

That same gap opened a route to losses on payments still in flight: an attacker could let the incoming leg of a relayed payment expire, then publish an older channel state and use the payment secret to collect the outgoing leg for itself. Eclair now force-closes using the newest state that is backed by a fully signed funding transaction, closing that timing window.

The third bug hit on-the-fly funding, a feature that opens a channel while forwarding a payment. A malicious wallet could time payment expiries so it collected the outgoing payment on-chain while the incoming leg expired, leaving the relay operator to eat the loss; Eclair now checks relay fees and expiry buffers before committing funds.

BTCPay Server Reports Separate Bots Probing Exposed LND Nodes

The Eclair fixes land as operators of Bitcoin’s other major Lightning implementation face a distinct threat. Payment processor BTCPay Server said earlier in September that it observed bots repeatedly probing servers where administrators had manually re-enabled external access to LND.

The attackers targeted an unauthenticated password-change endpoint during the brief window when an LND wallet sits locked, and a successful hit would let them replace the wallet password and request an administrator macaroon controlling the node.

BTCPay responded by issuing unique passwords per LND wallet and blocking unauthenticated wallet-management routes at its network edge, while advising operators against manually exposing the LND API at all.

Together the two incidents point to attackers systematically probing Lightning software for weaknesses that let them seize or redirect funds. As more builders ship Bitcoin-adjacent code quickly, the burden of catching these edge cases before deployment falls increasingly on protocol maintainers rather than automated tooling.

The CCS read. For institutions running or custodying Lightning liquidity, the lesson is operational, not speculative: patch cadence and default fee ceilings now function as risk controls comparable to key management. Firms that let node software drift unpatched are effectively underwriting counterparty risk against every peer they route through, a cost that belongs on the same ledger as custody and slippage.

ACINQ has not disclosed whether any operator lost funds to the closing-fee exploit before the September 14 patch, leaving that question open for node operators reviewing their own historical channel closures against the fixed logic in Eclair 0.14.3.