Lightning Network’s October: Volume Up, Capacity Down 37%

On the last day of October 2026, the Lightning Network is at once the busiest and the thinnest it has ever been. Over the past year Bitcoin’s best-known payment layer has cleared more than $1 billion in a single month by several estimates, Tether’s USDT now moves across its channels, and exchanges route a growing slice of their bitcoin withdrawals through it. Yet the amount of bitcoin sitting in public payment channels has slipped to roughly a third below its December 2025 record, and in the first days of the month the two most widely used node implementations rushed out emergency security fixes within about a day of each other.

That split screen, rising usage against shrinking visible capacity, is the real Lightning story of 2026, and it broke into the open in October. A prominent Bitcoin developer called the network a years-long exercise in self-deception; the people who build Lightning wallets and liquidity tools fired back that the critique describes 2019, not now. With Bitcoin trading near $77,000 on October 31 after a sharp monthly pullback, according to CoinDesk, the argument is not academic. It goes to whether Lightning is becoming Bitcoin’s cash layer or quietly turning into a settlement network for custodians and stablecoins. This piece walks through the numbers, the bugs, the custody fight, and what it all means.

The paradox in one snapshot

Public channel capacity is the headline figure most people quote for Lightning, and it tells a story of decline. Research house Spark put public capacity at about 4,898 BTC across roughly 41,080 channels and 17,438 nodes in May 2026, down from a December 2025 peak near 5,637 BTC, which was itself an all-time high, in its state-of-the-network report. By late October the slide had steepened: one widely cited dashboard showed capacity about 37% below the December record, or close to 3,550 BTC, according to TokenPost. At a price near $77,000, that is only a few hundred million dollars of bitcoin committed to the public graph.

Those numbers come with a large asterisk. Different explorers disagree sharply, because many count channels that are effectively dead or liquidity that has not moved in months. On the same late-October day one tracker reported roughly 2,500 BTC while another showed well above 3,500 BTC, and the mempool.space project has an open issue about node rankings listing dead nodes with stale capacity. Treat any single capacity print as a direction, not a decimal. The direction has been down for most of two years, with a brief rebound into the December 2025 top before the current drawdown.

Now set that against usage. Lightning cleared about $1.17 billion in November 2025 across some 5.22 million transactions, with an average payment near $223, growth that researchers pegged at well over 200% year-on-year. Commercial processor data cited by Cointelegraph put Lightning at 9.6% of all the Bitcoin payments it handled in the first half of 2026. Volume up, capacity down. Holding both facts at once is the whole game.

A fast refresher: what Lightning actually does

Lightning is a network of two-party payment channels built on top of Bitcoin. Two participants lock bitcoin into a shared on-chain output, then exchange signed balance updates off-chain, as many times as they like, without touching the base layer. Only the opening and the closing of the channel are Bitcoin transactions; everything in between is a private running tally secured by cryptography and by each side’s ability to broadcast the latest state if the other tries to cheat.

Payments hop across the network using hash time-locked contracts, or HTLCs, which let a payment route through strangers without any of them being able to steal it. If a node in the middle tries to keep the money, the structure of the contract either forces it to reveal a secret that releases the funds forward or lets the sender reclaim them after a timeout. That design is what makes Lightning fast and cheap, and it is also where this month’s bugs lived.

The critical catch is that Lightning security is not passive. A channel is only as safe as someone’s willingness to watch the Bitcoin chain and respond if a counterparty broadcasts an old, favorable balance. Most users never do this themselves; they rely on software, on third-party watchtowers, or on a custodian to do it for them. That reliance is the hinge on which the entire 2026 debate turns, and it is why the question of who runs the node matters as much as whether the protocol works.

The October patch wave: two implementations, days apart

The month opened with back-to-back security releases. On October 2, the Core Lightning team issued an urgent notice that attackers were actively targeting nodes running version 26.06.7 or earlier and told operators to upgrade to 26.06.8 at once, according to a write-up at TFTC. The release closed several confirmed bug classes, including a channel-closing flaw that could cost an operator funds. An active-attack warning is rare in Lightning land, and it set the tone for the week.

Around the same time, the Lightning Development Kit, the Rust library that powers a large share of newer wallets and services, shipped versions 0.1.13 and 0.2.7, with a 0.3 release candidate following, TokenPost reported. The maintainers advised any production user that interacts with untrusted peers to update promptly. Both fixes are visible in the project’s public release history on GitHub. Whether either flaw was ever exploited in the wild is, as of this writing, unknown.

Two of the three or four implementations that carry real volume patching serious issues in the same week is less a coincidence than a sign of scrutiny. More researchers are poking at Lightning now that there is over $1 billion a month and, increasingly, dollar stablecoins flowing through it. The attacks that matter here do not break Bitcoin’s cryptography. They exploit the messy edges of how channels reconnect, close, and account for in-flight payments.

Anatomy of the reconnect bug

The LDK flaw is worth understanding because it shows how Lightning theft actually works, and it is nothing like guessing a private key. A malicious channel peer would acknowledge a channel update, drop the connection, then after reconnecting falsely claim it had never received that update. A vulnerable application could be tricked into signing a conflicting commitment transaction at the same index, per TokenPost’s account. The attacker could then publish that stale state and try to claw back bitcoin after an incoming HTLC expired, pocketing money that should have stayed committed to the channel.

Version 0.2.7 also addressed a separate issue in LSPS2, the specification Lightning service providers use to sell inbound liquidity. The bug let a client request amounts larger than the incoming HTLCs justified, which could coax a provider into opening a channel that forwarded more bitcoin than it actually received. Different mechanism, same theme: the danger sits in bookkeeping and state management, not in the math that protects the coins.

None of this means Lightning is uniquely fragile. Every payment network, from card rails to other blockchains, carries implementation risk, and the fact that these flaws were found, disclosed, and patched quickly is how a maturing system is supposed to behave. The worry is narrower: as more value and more stablecoins concentrate on a handful of large, always-online nodes, the payoff for finding the next reconnection or accounting bug grows, and so does the incentive to go looking for it.

This is the recurring lesson of 2026’s security news across crypto, and it is not unique to Lightning. As HOGE Wire documented in its account of October’s wallet attack wave, the expensive failures almost never involve a cracked key; they involve tricking software or a human into authorizing something. Lightning’s version of that truth is that a channel is a tiny piece of software holding real money, and the bitcoin stays safe only as long as the software and its watchers behave.

Why capacity is falling while payments climb

If more money is moving, why is less money parked in channels? The short answer is that the two figures measure different things. Capacity measures bitcoin committed to public, routable channels. Volume measures payments, many of which never touch the public graph at all because they happen inside a single custodian or between an exchange and its own users.

Several forces push public capacity down at once. Node operators have learned that idle liquidity is expensive; capital sitting in a rarely used channel earns nothing and could be working elsewhere, so operators trim. Routing has professionalized, with a smaller number of large, well-managed nodes handling most hops while many hobbyist nodes go dark. Spark’s data shows node counts down meaningfully from a 2022 peak around 20,700, a drop on the order of 15% to 20%, even as throughput climbed. Fewer, bigger, better-run nodes can carry more payments on less advertised capacity.

The decline is also less linear than the headline suggests. Public capacity peaked around 5,400 BTC in late 2023, bled down to roughly 4,200 BTC by August 2025, then rebounded to the December 2025 record before rolling over again, Spark’s figures show. That saw-tooth pattern tracks sentiment and price as much as usage: capital floods in during bull runs, when opening channels feels cheap, and drains out when operators would rather hold their bitcoin or deploy it elsewhere. The 2026 drawdown is the sharpest leg of that cycle so far.

The uncomfortable implication is concentration. A network that was sold as a peer-to-peer mesh is, by its own public metrics, consolidating routing power into a shrinking set of professional operators and custodial hubs. That can be read as healthy efficiency or as creeping centralization, depending on who is talking. It is almost certainly both at the same time, and which reading you prefer tends to track what you wanted Bitcoin to become in the first place.

The custody fight: Sztorc versus the builders

The data fight became a personality fight in early October. Bitcoin developer Paul Sztorc, a longtime skeptic of Lightning’s roadmap, wrote that “most people don’t realize how bad the Lightning Network is” and blamed what he described as a years-long campaign to misrepresent its user experience, even likening custodial Lightning marketing to the Theranos fraud, in remarks gathered by Cointelegraph. His sharpest claim: custodial services, not self-run channels, account for more than 80% of Lightning payments.

The builders pushed back hard. Jesse Shrader, co-founder and chief executive of the Lightning analytics firm Amboss, argued that reliability is far better than critics allow, saying that “for everyday payments of around $100, most users can achieve 99% reliability” and that his firm’s simulations put the success rate for $100 payments above 99.6%. He also disputed the headline number directly, saying he distrusts anyone who claims to prove an 80% custodial share, since the whole point of custodial and private usage is that it is hard to measure.

Not every builder dismissed the critique. Alex Bosworth, a veteran Lightning engineer, conceded that “the painful truth is that in a setup with privacy and p2p etc it’s extremely slow compared to tap to pay,” a candid admission that fully self-sovereign payments still lag a contactless card. Danny Stagg of wallet maker Breez took the middle ground, telling Cointelegraph that “the criticism is not fair in 2026, but historically it was” and that non-custodial user experience is now comparable to custodial. The disagreement is not really about whether Lightning works. It is about what counts as Lightning.

The reliability question: 99% of what?

Both camps can cite true numbers because they are measuring different payments. A $20 coffee tab routed through a well-connected custodial wallet with pre-funded liquidity is close to instant and almost never fails. A $2,000 self-custodial payment that has to find a multi-hop path through strangers, respecting each channel’s balance and fee policy, is a harder problem, slower, and more likely to retry. Amboss simulations describe the first world; Sztorc’s frustration describes the edges of the second.

Payment size is the hidden variable. With an average Lightning payment around $223, the network is tuned for small, everyday amounts, which is exactly where reliability is highest and exactly where a custodial shortcut is most tempting. Push the amount up or demand full privacy and peer-to-peer routing, and the experience degrades, just as Bosworth admitted. The honest summary is that Lightning is excellent at small, assisted payments and still awkward at large, fully sovereign ones.

That nuance is usually lost in the online brawl, where a 99% success rate and an 80% custodial share get hurled as if they contradict each other. They do not. You can have a network that works beautifully for most payments precisely because most payments lean on a trusted operator to manage liquidity and watch the chain. Whether that should count as a win is a values question, not a metrics question.

Stablecoins on Lightning: Taproot Assets changes the product

The single biggest change to what Lightning is for arrived in 2026. On March 21, Tether chief executive Paolo Ardoino confirmed that USDT had gone live on Bitcoin’s Lightning Network through the Taproot Assets protocol, completing an integration that had been in the works since early 2025, as Forbes reported. For the first time at scale, the world’s largest dollar stablecoin could move over Bitcoin rails at Lightning speed.

Taproot Assets is Lightning Labs’ system for issuing tokens that settle on Bitcoin and route over existing Lightning channels. The team shipped version 0.6 in mid-2025, the first multi-asset Lightning release on mainnet, and had reached version 0.8 with a public developer kit by mid-2026, per Spark’s protocol overview. USDT and USDC are live, alongside experiments such as a Brazilian real stablecoin and sterling-denominated tokens.

The appeal is clearest outside wealthy countries. A sender in the United States can push dollars to a recipient in Brazil or Nigeria who wants dollars, not volatile bitcoin, and the payment settles in seconds for a fraction of a traditional remittance fee. That is why a Brazilian real stablecoin like DePix showing up in the Taproot Assets ecosystem matters more than it might look: it points at local, real-world rails rather than speculative trading. Lightning’s dollar future, if it has one, probably runs through remittances and merchant settlement rather than coffee payments in San Francisco.

This is a genuine product shift, and it cuts two ways. On one hand it gives Lightning a use case ordinary people obviously want: fast, cheap dollars. On the other it deepens the very concentration the capacity numbers hint at, because stablecoin issuance and the edge nodes that convert between bitcoin and dollars tend to be run by a handful of well-capitalized operators. Bitcoiners who wanted a purely peer-to-peer cash network did not necessarily sign up for a dollar-transfer layer, which is part of why the token debate on Bitcoin, from US regulatory pressure on stablecoins led by the SEC to the culture war over Bitcoin-native assets, stays so heated.

The routing economy: who actually earns

Behind the capacity decline sits a simple business reality: running a routing node barely pays. Spark’s analysis of routing revenue found that most nodes earn thin returns on the capital they commit, with meaningful income concentrated among the largest, best-connected operators that can command flow and set fees, in its profitability study. For a small operator, the yield on bitcoin tied up in channels often fails to beat the opportunity cost of simply holding it.

That math explains the thinning graph. When routing fees are tiny and liquidity management is a part-time job, hobbyists close channels and move on. The nodes that remain are run by businesses: exchanges, liquidity service providers, and specialized routing shops that treat the work as infrastructure rather than a hobby. They are better at keeping channels balanced and payments flowing, which is why throughput can rise even as advertised public capacity falls.

It is a familiar pattern in Bitcoin. The same professionalizing pressure reshaped mining, where margins and metrics like hashprice pushed the activity from bedroom rigs toward industrial operators. Lightning routing is quietly going through its own version of that shift, trading the romantic image of a volunteer mesh for the efficiency of a smaller set of serious players. Efficiency and decentralization are pulling in opposite directions, and so far efficiency is winning.

Exchanges became the network’s hubs

Nothing concentrates Lightning like an exchange. After Coinbase finished its integration, more than 15% of the bitcoin withdrawals leaving the platform were using Lightning by the middle of 2025, according to figures cited in Spark’s state-of-the-network work. Kraken, River, Cash App, and Strike route large flows too, and new venues keep plugging in, with WhiteBIT adding Lightning deposits and withdrawals in October 2026. Each integration brings real users and real volume, and each one routes that volume through a small number of very large channels.

For most people, an exchange or a custodial wallet simply is Lightning. They tap send, the payment clears in a second, and they never run a node or manage a channel. That is exactly the experience Sztorc points at when he says the usable network is mostly custodial, and exactly the experience Breez and Amboss say is now matched by non-custodial apps. Both can be true: the median payment is custodial, and the best non-custodial apps are far better than they were two years ago.

The risk is the old one. Custodial Lightning reintroduces the counterparty you used Bitcoin to avoid. When a custodian fails or is breached, users can lose funds that never had anything to do with a channel bug, a point HOGE Wire has made repeatedly, including in its look at how a $387 million exchange hack turned on operational failures rather than broken cryptography. Lightning does not change the rule that if you do not hold the keys, you hold a promise.

The quantum clock starts

Longer term, Lightning faces a threat its base layer shares but must solve separately. In mid-October, a team led by Dr. Ahmet Kurt, spanning East Texas A&M University, North American University, Florida Gulf Coast University, and the Florida Institute of Technology, published what they describe as the first complete post-quantum security implementation for Lightning, Bitcoin Magazine reported. Because Lightning runs its own messaging and payment cryptography, a future quantum computer could threaten it independently of Bitcoin’s mainnet.

The researchers’ approach is pragmatic. Rather than rip out existing cryptography, they layer NIST-standardized quantum-resistant algorithms, ML-DSA for signatures and ML-KEM for key exchange, on top of the classical schemes, so an attacker would have to break both the old and the new to win. The work was implemented in the Rust Lightning stack across roughly 11,000 lines of code over a few months, a proof that hardening is feasible without a clean-sheet redesign.

No one thinks a cryptographically relevant quantum computer is arriving this year. But Lightning channels can be long-lived, and data captured today could be attacked later, so the lead time matters. That a small academic team could stand up a hybrid defense in months is a quietly encouraging data point in a month that was otherwise about leaks and declines.

How Lightning compares to the other Bitcoin rails

Lightning is not the only way value moves on or around Bitcoin, and the alternatives sharpen what Lightning is and is not. The base layer settles with full security but slow, roughly ten-minute blocks. Federated sidechains like Liquid move bitcoin and assets quickly but ask you to trust a federation. Newer designs such as Ark and statechain-style systems chase Lightning’s speed with different trust and liquidity tradeoffs. And dollar stablecoins already run cheaply on other chains, which is the competition Taproot Assets is really fighting.

Seen this way, the capacity decline looks less like failure and more like specialization. Lightning is winning the niche it is best at, fast low-value payments and stablecoin transfers between businesses and apps, while shedding the speculative, over-provisioned capacity of its 2024 and 2025 hype cycles. Whether that is the network Bitcoiners wanted is a separate question from whether it is working.

What it means for Bitcoin as money

Strip away the personalities and October left one durable question. If most Lightning payments are custodial, and the fastest-growing cargo on the network is dollars rather than bitcoin, is Lightning still the peer-to-peer electronic cash system the white paper imagined, or is it becoming a high-speed settlement layer for custodians and stablecoin issuers? The honest answer is that it is becoming both, and the mix is sliding toward the latter.

That is not automatically a defeat. A payments layer that moves a billion dollars a month and lets a worker in one country send dollars to family in another for pennies is doing something useful, whatever the ideological label. But it does change the pitch. The promise shifts from be your own bank to use fast money that happens to settle on Bitcoin, and those are different products with different risks. Self-custody still matters, and the same discipline that applies to hardware wallets and seed phrases applies to anyone running their own Lightning node: your money is only as safe as your keys and your backups.

For Bitcoin’s long-term security budget, the stakes are larger than they look. As block subsidies shrink, the network will lean more on fee revenue, and layers that batch thousands of payments into a few on-chain transactions are both a blessing, because they add utility, and a pressure, because they reduce the base-layer fees miners collect. Lightning’s shape in 2026 is quietly part of that bigger conversation about how Bitcoin pays for its own security over the coming decades.

What to watch into year end

Several threads will decide whether October was a blip or a turning point. Watch whether public capacity stabilizes or keeps sliding into 2027; a floor would suggest the network found its efficient size, while continued decline would sharpen the centralization worry. Watch Taproot Assets adoption, because every new stablecoin flow pulls Lightning further toward a dollar-transfer role. And watch the implementations, because after an active-attack warning, the speed and transparency of the next disclosure will say a lot about the ecosystem’s maturity.

• Capacity trend: does the roughly 37% drawdown from the December 2025 peak find a floor?
• Custodial share: can anyone actually measure it, and does it keep rising?
• Stablecoins: how fast do USDT and USDC volumes grow on Taproot Assets?
• Security cadence: how do Core Lightning, LDK, and others handle the next disclosure?
• Regulation: how US stablecoin oversight evolves, and whether it reaches Lightning-routed dollars.

The through line is that Lightning in late 2026 is a more serious, more concentrated, more useful, and more scrutinized network than the one its earliest evangelists described. It moves real money. It also depends on trust and professional operators to a degree that makes some of its founding promises read as aspirations. Both things are true, and pretending otherwise, in either direction, is how you end up in a Theranos argument on the internet.

Frequently Asked Questions

Why is the Lightning Network’s capacity falling in 2026?

Public channel capacity has slipped from a December 2025 peak near 5,637 BTC to somewhere between about 2,500 and 3,550 BTC by late October 2026, depending on the tracker. The main reasons are economic, not technical: idle liquidity earns little, routing has concentrated among larger professional operators, and many hobbyist nodes have closed channels. Payment volume has kept rising even as advertised capacity falls, because efficient nodes and custodial services move more money on less committed capital.

Is the Lightning Network safe to use after the October 2026 bugs?

The flaws patched in early October affected specific node software, Core Lightning before version 26.06.8 and older LDK releases, and both were fixed quickly with no confirmed thefts reported. If you run your own node, update to the latest version immediately. If you use a reputable custodial or managed wallet, the provider handles patching. The bugs targeted channel bookkeeping and reconnection logic, not Bitcoin’s underlying cryptography.

Can you send USDT or stablecoins over the Lightning Network?

Yes. Since March 2026, Tether’s USDT has been live on Lightning through the Taproot Assets protocol, and USDC and other tokens are supported as well. Taproot Assets lets tokens issued on Bitcoin route over existing Lightning channels, so dollar stablecoins can move at Lightning speed and cost. This is one of the biggest changes to the network, turning a Bitcoin-only payment layer into a multi-asset one.

How much volume does the Lightning Network process?

Estimates vary because much activity is private, but Lightning cleared on the order of $1 billion or more in a single month during 2025 and 2026, with one widely cited figure of about $1.17 billion across 5.22 million transactions in November 2025. One commercial processor reported Lightning at roughly 9.6% of the Bitcoin payments it handled in the first half of 2026. Precise totals are impossible because custodial and in-app payments do not appear on the public graph.

Is the Lightning Network centralized or custodial?

It is more concentrated than its peer-to-peer image suggests. Critics such as developer Paul Sztorc argue that custodial services account for more than 80% of payments, a figure builders at Amboss and Breez dispute as unmeasurable. What the public data does show is fewer, larger routing nodes and heavy reliance on exchanges and managed wallets. Fully self-custodial Lightning works but asks more of the user, while most everyday payments run through a trusted provider.

By the HOGE Wire bitcoin desk, reporting on Bitcoin’s base layer and the networks built on top of it.