Core Lightning Patches AI-Found Bitcoin Wallet Bug
Core Lightning confirmed on 26 August 2026 that AI-generated audits caught real bugs in its Bitcoin payment routing code. An emergency patch is coming. If you run a Lightning node, or use an app that does, this affects whether your payments move.
What actually happened
The team behind Core Lightning, a widely used Bitcoin Lightning Network client, said on X that developers and outside reviewers spent 10 days confirming AI-flagged vulnerabilities, according to Decrypt. They urged operators to verify signatures and install the coming update 'promptly rather than eventually.' Anyone who cannot patch right away should restart with the --offline flag instead of shutting down, since a running node can still react if a channel partner force-closes. Version 26.04 loses support once the fix ships. The next release, 26.09, arrives late September 2026. Bitcoin traded at $79,337 (USD) as of 10:40 UTC on 28 August 2026, down 0.17% over 24 hours, per CoinGecko data cited by Decrypt.
How we got here
This marks the third AI-linked Bitcoin security scare in three months. In July, hardware wallet maker Coinkite said an attacker likely used AI to expose a weakness in Coldcard seed generation, a bug tied to stolen funds. Weeks later, swap service Boltz paused operations after AI-assisted attackers found bugs faster than its team could fix them. The volunteer Bitcoin Red Team says AI review has surfaced 4,962 possible findings across 390 projects, with 85 rated critical, according to Decrypt. A group member told the outlet the team exists to stay ahead of attackers.
Why this matters for you
If you hold Bitcoin in a standard wallet or cold storage, this bug does not touch you directly. The risk sits with node operators routing Lightning payments, including services some wallets rely on behind the scenes. For everyday bonuz.market users, the practical step is simple: check whether any Lightning-based payment rail you use depends on Core Lightning, and expect brief slowdowns as operators patch. For builders integrating Lightning into apps, this is another reminder that AI-assisted audits now find real flaws faster than manual review alone.
The bigger question
AI tools are now finding real flaws in wallets, swap services, and payment channels faster than human reviewers manage alone. That pattern has repeated three times in three months. As that gap widens, who takes responsibility for auditing the software millions of people never see, wallets, nodes, routing code, before attackers get there first?
What to watch
Core Lightning's vulnerability details stay under embargo for about two weeks from 26 August 2026. Version 26.09 ships late September 2026, and 26.04 support ends the same day the fix lands. Separately, Starkware says it mined an experimental quantum-safe Bitcoin transaction this week, a sign Bitcoin's cryptography faces more than one long-term test, per The Defiant.
