cant wait to vote against these imbeciles in the midterms

omg i just realized you replied to me a month ago in defense of blockstream's handling of the situation

#1555848

i hope you're willing to help me share in frustration that they have let us users down!

Blockstream have not done anything wrong here,

And a month later you're posting about possibly having lost money:
#1585578

I'm genuinely sorry for your loss. And I realize i was emotional during my original post, insensitive maybe, but the mishandling of the situation is undeniable.

Been poking at this from the chain side. Few things that might help:

The ALL-CAPS node names are a dead end. That's just the alias CLN auto-generates from the node id when nobody sets one. The attacker never bothers naming their nodes, so they come out SOMBERPLOW, UNITEDSPORK and so on.

Looks like two different bugs with the same ending, both already patched. One's the splice bug (commit c65eec30, 14 Sep): close after a splice locks and your node rebroadcasts an old revoked commitment, then your own onchaind gives up on the outputs. That's your "did we cheat?" line. The other's the dual-funding RBF one fixed in 26.06.8, where the node ends up watching the wrong funding output completely. Either way they route their balance out through you first and then grab it again on the close.

I followed the money too: on the recent batch every channel was funded straight out of a FixedFloat hot wallet, about one withdrawal per channel. The proceeds run back through round-number consolidations into deposit addresses at another big exchange..

Sorry to all those affected, this one's nasty. Happy to compare txids if people post them.

Are you sure these a certainly malicious nodes? ADJECTIVE+NOUN in caps is the alias CLN generates from the node id when the operator never sets one.

There is an ongoing attack however, I have been researching it.

Do you have experimental dual funding enabled? There was an attempted attack on my node which i have documented related to that.

This is extremely disappointing from Blockstream.

Core lightning has been some of my favorite bitcoin software for many years, i have championed it in both Dev and adoption realms.

And now... to see a small group of insiders be alerted of critical issues, with zero proper public disclosure or announcement? This is not how you do security fixes or look after users.

What if this semi-quiet embargo announcement had piqued the interest of evil individuals (it certainly has now, AIs are being pointed at the repo right fucking now)?

What if I had lost funds or private information regarding customer data?

Why the fuck is someone called MADELINEVIBES, who did an "introduction to github" LAST YEAR, managing security releases for mission critical software?