Electrum Updates Lightning Backup Security Following Channel Defect
Electrum released a security update on Sept. 11 to address a defect in Lightning backup exports, though users with specific wallet configurations must manually replace their existing backups.
Electrum has issued a fix for a security defect affecting Lightning channel backups. The update, included in version 4.8.2, addresses an issue where certain backups lacked the necessary key information to reclaim funds from anchor channels after a remote close.
The vulnerability specifically impacts wallets that utilize non-deterministic Lightning keys and anchor channels. Because non-deterministic keys cannot be reconstructed from a standard wallet seed, users with affected backups may be unable to sweep their funds on the Bitcoin blockchain if a channel is closed by a peer.
Wallets that rely on BIP39 seeds or imported extended private keys are considered to have non-deterministic Lightning keys. For wallets created with Electrum seeds, those generated in version 4.1 or later use deterministic keys, while those from version 4.0.x do not.
The fix, identified as PR 10851, ensures that wallet-file exports retain a randomly generated Lightning private key that was previously deleted. Additionally, the software now hides the option to request a remote force-close if the backup is unable to claim the resulting output.
Simply upgrading to the latest version of the software is not sufficient to recover lost key material. Users with affected wallets must generate fresh exports, a process that requires the original wallet data to be intact. Affected users will see a warning upon startup, and the software now includes indicators on desktop and Android to identify channels that cannot be recovered from a seed.
