Lightning Network Channel Probing: How Attackers Map Node Balances & Public IPs

The Layer-2 Liquidity Landscape of Bitcoin Lightning

The Bitcoin Lightning Network processes millions of instant, low-fee micropayments by routing funds across payment channels. While transactions do not appear on the Bitcoin base chain, routing node operators face sophisticated Network Probing & Balance Fingerprinting Attacks.

How Malicious Actors Execute Channel Probing

Because Lightning utilizes Onion-routed Hash Time Locked Contracts (HTLCs), intermediaries only know the previous and next hops. However, attackers exploit payment failure error codes to deduce channel balances:

• Binary Search HTLC Probing: The attacker routes a series of fake payments (e.g., $100, $500, $1000) designed to fail at the target hop with INCORRECT_OR_UNKNOWN_PAYMENT_DETAILS or TEMPORARY_CHANNEL_FAILURE.
• Mapping Private Channel Liquidity: By measuring which payment amounts succeed or fail, attackers deduce the exact satoshi balance of private payment channels within minutes.
• IP-to-Node Correlation: If the routing node does not operate over Tor, the probed balance is directly tied to the node operator public residential IP address.

Defending Your Routing Node

1. Operate Exclusively as a Tor v3 Hidden Service: Set listen=onion in lnd.conf or cln.conf.
2. Enable Shadow Routing / Multi-Path Payments (MPP): Splits larger transfers across multiple routes, obscuring single channel balance thresholds.

Read our technical guide on running Bitcoin nodes as Tor hidden services.

Verify that your Web3 network does not leak residential IP metadata using our free online IP scanner.