ACINQ said it released Eclair 0.14.3 on Sept. 14 to fix three vulnerabilities in its Bitcoin Lightning implementation, including one that could let a malicious channel peer push a victim’s local balance into miner fees during a cooperative channel close.

According to ACINQ’s disclosure, the most severe issue affected cooperative channel closures. A malicious counterparty could propose a closing fee higher than the victim’s available balance, causing the entire local balance to be paid out as miner fees. Eclair 0.14.3 now rejects fee proposals above the configured maximum.

ACINQ also patched a second flaw tied to splicing, where funds could become stranded if a splice was left unfinished. A third issue involved on-the-fly funding, where a malicious wallet could manipulate payment timing. The updated software now checks relay fees and expiry buffers before committing funds and adds a default cap for channel-opening fees.

The company said operators should upgrade to avoid exploitation. The available information does not include a formal CVE reference or a detailed affected-version list beyond the release of Eclair 0.14.3, and there is no confirmed report in the provided material that the flaws were exploited in the wild before the patch.

Independent technical research cited in the supporting material describes a related Eclair weakness in on-chain monitoring during force-close conditions, where a node could fail to detect a revealed preimage if it only tracked HTLCs from its local commitment state. That issue points to a broader Lightning security challenge: channel safety can depend on how implementations handle old but still valid commitment states, fee updates, and on-chain settlement edge cases.

Why It Matters

This patch matters because Eclair is infrastructure software, and failures at the channel-management layer can translate into direct fund loss even when Bitcoin itself is operating normally. For Lightning users and service operators, the news is a reminder that operational security depends not only on custody and keys, but also on timely client updates and reliable handling of close-out scenarios.

It also adds to a wider pattern of Lightning implementations tightening defenses around fee logic and forced channel closure behavior. As more activity relies on off-chain payment rails, implementation-level bugs may draw more attention from operators, wallet providers, and infrastructure firms that depend on predictable settlement behavior.