Research

Research papers, with the code and data behind every number.

Each paper takes one question about how Bitcoin and its payment networks behave and answers it from public data. The preprints are on arXiv, and every figure, table and number in them is produced by code published alongside.

Series · Lightning security

How does the Lightning Network hold up when its software fails?

Lightning is a payment network built on Bitcoin, run by thousands of independent operators on four open-source implementations. In 2026 every implementation disclosed security vulnerabilities. This series measures, from public gossip and the chain, how the network held up and how operators responded.

Paper 01 · Who fails? arXiv:2610.20952 · v2

Does Client Diversity Protect the Lightning Network?Evidence from the 2026 Core Lightning Shutdown

Saurabh Kumar · Bitcoin Data Labs · October 2026 · cs.CR, cs.NI

The damage from a software failure depends on whether it reaches the network's hubs, not on how many nodes run the failing software.

LND runs 80% of public Lightning nodes and 84% of public channel capacity. When Core Lightning's maintainers told operators who could not upgrade to disconnect on 26 August 2026, 22% of its nodes went dark overnight, yet reachability across the network fell by 7.8 percentage points, half the drop during a Tor denial-of-service wave that July. Diversity statistics that count nodes mislead; the number to track is which software the hubs run.

84%of public channel capacity runs on one implementation, LND
22%of Core Lightning nodes went dark overnight, ten times the usual rate
4×more reachability lost if ACINQ's Eclair node fails alone than if all 619 routable CLN nodes do
Read on arXiv PDF Code & data
RelatedThe Summer Lightning Broke (a Little)plain-language deep diveLightning Dashboardthe live network
Two stacked area charts, 2023 to 2026: LND's share of node capacity stays between 84% and 90%, while its share of public nodes falls from 91.8% to 84.2%.
Share of public nodes (a) and of node capacity (b) by implementation, 2023–2026. LND's share of capacity has barely moved.
Paper 02 · Who patches? arXiv:2610.30350 · v1

Who Patches the Lightning Network?Evidence from Release Lines in Gossip, 2023–2026

Saurabh Kumar · Bitcoin Data Labs · October 2026 · cs.CR, cs.NI

Lightning nodes patch on release and platform schedules, not when a security advisory is published.

Gossip carries no software version, so whether operators act on advisories had never been measured. Matching the feature bits each node announces against every LND, Core Lightning, Eclair and LDK release reveals its release line. Across 814 daily snapshots from 2023 to 2026, the three largest LND upgrade waves came about a day after the Umbrel app store shipped a new version. For maintainers, the lever on the nodes that lag is the platforms that package their releases.

88 daysfor half of LND nodes on an older line to upgrade after a release
1 of 12security disclosures we could test measurably sped up upgrades
71%of LND nodes exposed by Lightning Labs' August 2026 disclosures still ran an affected release two months later
Read on arXiv PDF Code & data
RelatedDoes Client Diversity Protect the Lightning Network?paper 01, the client labels this paper builds onOSS App Statsrelease cadence of Lightning implementations
Daily upgrade counts for LND and Core Lightning nodes, 2024 to 2026, with spikes that follow Umbrel app-store releases.
Upgrades per day, LND (top) and Core Lightning (bottom). Dashed lines mark upstream releases, triangles Umbrel app-store releases; the largest LND waves follow Umbrel.

How we do research

  1. Every number comes from code

    Each figure, table and quoted number is written by the pipeline in the paper's repository, from a fixed data cutoff. Nothing is typed in by hand.

  2. Aggregates only

    Security results are published as totals. No list, ranking or label of individual nodes by software release or exposure appears in a paper or its data, and we don't provide one on request.

  3. Public inputs

    The papers read the public Lightning gossip graph and the Bitcoin blockchain. Our daily snapshots of them are available to researchers on request.

  4. Measure, don't advocate

    We report what the record shows about clients, operators and maintainers, including when it is not what anyone expected.

Using our research?

Researchers · Journalists · Maintainers

Cite the arXiv version; each paper's Cite button gives the BibTeX. For questions about the method, a cut of the data the paper doesn't show, or an interview, write to the author.

sorukumar@bitcoindatalabs.org

Also from the lab

Investigations and deep dives.

Shorter pieces that answer one question with on-chain or network data, with the methodology published next to the findings.

Read Deep Dives Coldcard RNG investigation Mining Pool Profiler Full catalog