Critical Eclair Lightning Vulnerability Is Publicly Disclosed
Security researcher Matt Morehouse publicly disclosed a critical vulnerability affecting Eclair 0.11.0 and earlier that could allow a malicious channel peer to steal funds during a force-close sequence. The flaw had already been fixed in Eclair 0.12.0 before public disclosure.
On September 23, 2025, security researcher Matt Morehouse publicly disclosed a critical vulnerability affecting older versions of Eclair, one of the principal Lightning Network node implementations. The flaw affected Eclair 0.11.0 and earlier and could allow a malicious channel peer to exploit the way Eclair extracted payment preimages from on-chain transactions during certain force-close states.
Lightning payments use hash time-locked contracts, or HTLCs, whose settlement depends on a secret preimage being revealed and propagated backward through a payment route. When a channel closes on-chain, a node must correctly identify relevant preimages in commitment transactions so it can claim the funds owed to it upstream. The vulnerable Eclair versions could ignore a preimage appearing in a counterparty's older commitment state because the corresponding HTLC was no longer present in Eclair's own local commitment. An attacker could deliberately construct that condition and cause the Eclair node to lose the affected HTLC value.
The bug had been responsibly disclosed and fixed before the public announcement; users were told to upgrade to Eclair 0.12.0 or later. Bitcoin Optech independently summarized the vulnerability and its fund-theft implications. The September disclosure illustrated the continuing complexity of safely implementing Lightning’s off-chain state machine even when the underlying Bitcoin protocol remained unaffected.