Details on both incidents remain unconfirmed at the time of writing. Specific loss figures, root causes, and the number of affected users or services have not been independently verified.
Reported incidents targeting Core Lightning, a widely used implementation of the Bitcoin Lightning Network, and MetaMask, the dominant Ethereum-compatible browser wallet, have drawn attention to a shift in how attackers are approaching the crypto ecosystem, moving from user-facing applications toward the infrastructure and tooling layers beneath them.
Details on both incidents remain unconfirmed at the time of writing. Specific loss figures, root causes, and the number of affected users or services have not been independently verified. Users of either product should consult official project communications before taking any action. For related coverage, see Illinois Delays Crypto Tax Amid Industry Lawsuit.
What to Know About the Core Lightning and MetaMask Incidents
Core Lightning, developed by Blockstream and formerly known as c-lightning, is one of several node implementations that power the Lightning Network, Bitcoin’s second-layer payment protocol. MetaMask is a browser extension and mobile wallet used to interact with Ethereum and compatible chains, with tens of millions of reported installs. Both sit at points in the stack that, if compromised, carry downstream risk for users and services that depend on them.
The reported targeting of these two products suggests attackers are looking below the most visible layer, exchanges and token-facing interfaces, toward the plumbing that routes transactions and manages keys. Compromising a node implementation or a wallet extension creates leverage across every user or service running that software, rather than requiring individual account-by-account exploitation.
Regulators have increasingly focused on custody and key management risk in this layer. Proposals such as the SEC’s crypto self-custody framework for institutional investors and expanded crypto custody options for investment advisers reflect growing policy awareness that the infrastructure beneath user-facing products carries systemic risk.
Why Attacks Are Moving Down the Crypto Stack
The crypto stack runs from end-user wallets at the top, through wallet libraries and signing interfaces, down to node software and network protocol implementations at the base. Historically, the most visible attacks targeted exchanges and bridges, where large pools of liquidity sit in accessible smart contracts or custodial wallets.
As exchange security and bridge auditing have matured, the attack surface has shifted. Wallet extensions like MetaMask sit between users and every on-chain action they take; a compromised extension can silently redirect transactions or harvest seed phrases across an entire install base. Lightning node software like Core Lightning processes real-time Bitcoin payment channels; a vulnerability there can affect routing nodes, merchants, and users simultaneously without the attack being visible until channels are drained.
Oversight structures are still catching up. State-level coordination efforts, such as New York and Wyoming’s joint oversight framework for crypto firms, address institutional conduct rather than open-source infrastructure security. The Lightning Network and browser wallet layers operate largely outside that perimeter.
What Users and Developers Should Watch Next
Anyone running a Core Lightning node should monitor the official Blockstream and Core Lightning GitHub repository and mailing lists for security advisories and patch releases. MetaMask users should verify they are running the latest extension version from the official browser store and treat any unexpected transaction prompts with heightened caution until the project publishes a public incident report.
The key facts still needed to fully assess both incidents include the scope of exposure, the specific vulnerability class or attack vector involved, confirmation of whether funds were lost, and which versions or configurations are affected. Until those details are public, any remediation steps should come directly from the respective project teams, not from secondary reporting.
For the Bitcoin network specifically, the Lightning layer carries particular weight. Lightning adoption depends on users and merchants trusting that node software handles key material and channel state correctly. Security incidents at the implementation level, even when quickly patched, slow the deployment of new nodes and reinforce the case for on-chain settlement over second-layer routing, a dynamic that developers and users will be watching closely as more details emerge. The broader question of how infrastructure-layer security fits within emerging institutional custody frameworks is likely to draw renewed scrutiny from policymakers.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
