Lightning Labs CTO: Security Issue Is User Error

Crypto News Exploits

Lightning Labs CTO: Security Scare Is User Error, Not a Software Flaw

Written by Aaron S.,

Editor-In-Chief

Last Updated: February 20, 2025

Key Takeaways

Lightning Labs’ CTO says a reported bug is not a software flaw but a user security issue;
Users with outdated LND or Lightning Terminal versions should update to avoid risks;
A separate cryptographic flaw in Bitcoin’s elliptic library raises security concerns.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Lightning Labs CTO: Security Scare Is User Error, Not a Software Flaw

BITDEGREE IN YOUR SOCIAL FEED

A recent security issue in the Lightning Network has raised concerns, but Lightning Labs' Chief Technology Officer (CTO) Olaoluwa Osuntokun has suggested the problem is not with the software itself.

Instead, according to Osuntokum's post on X, he pointed to a compromised user device as the likely cause.

The Lightning Network, a layer-2 solution designed to make Bitcoin BTC $89,696.09 transactions faster and cheaper, currently holds about 5,145 BTC, valued at approximately $500 million.

What is a Crypto Wallet? (Explained With Animation)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

In a February 19 post on X, Satoshi Labs co-founder Pavol Rusnak issued a warning about vulnerabilities in older versions of Lightning Network Daemon (LND) and Lightning Terminal.

He urged users to update immediately, stating that attackers exploited flaws patched in newer releases. His message specifically mentioned LND versions older than 0.18.5 and Lightning Terminal versions before 0.14.1.

Osuntokun responded, stating that the issue did not appear to be a direct flaw in LND. He explained that the affected user’s machine had been compromised, which may have allowed attackers to gain access to their funds.

This warning comes after another security issue was flagged on GitHub on February 13. A report highlighted a weakness in the ECDSA (Elliptic Curve Digital Signature Algorithm) used for Bitcoin transactions. The concern was that a flaw in the elliptic library, a JavaScript package used in cryptography, could expose private keys if numbers used once or "nonces" were reused.

Meanwhile, Microsoft recently issued a warning about an updated XCSSET malware. What kind of damage could it cause? Read the full story.