Latest Strikes #24 - June 8th - 14th 2026

Welcome to Latest Strikes, your weekly report of the latest Lightning-related news. Last week Bark was launched on mainnet, BitGo announced Lightning Earn, and a curious paper about Lightning Command & Control was published.

Lightning Earn

BitGo announced the integration of Amboss Rails into their custody offering. BitGo institutional users can deploy liquidity into an Amboss-managed Lightning node, through the BitGo API and without renouncing the custody of their coins (for self-custodial users, at least). BitGo itself "has deployed 10 bitcoin from its own treasury into Lightning Earn" which as of today represents around 15% of the total deployed in the Rails Cluster.

This announcement further solidifies Lightning's potential as a counterparty risk-free yield instrument, notably for institutional investors.

StackerNews Discussion

Lightning Command & Control

An interesting paper was published last week, proposing an evaluation framework and a test bed for the use of Lightning as Command & Control (C2) for botnets. When attackers want to leverage a botnet, they need to be able to pass instructions to the machines comprising the botnet. A traditional method is to use centralized C2 servers: machines in the botnet reach the server, get instructions and perform their (nefarious) tasks. However, an issue for attackers is that these centralized C2 servers tend to get shut down. They hence need to find ways to hide and decentralize command delivery — and one attractive option is to piggyback on payment-channel or blockchain systems that are hard to censor. For example, the Glupteba botnet famously used Bitcoin OP_RETURNs to let its machines learn new C2 server addresses if the hardcoded ones ever stopped responding.

Here, the explored idea is that the malware can run a Lightning node and receive commands through keysend payments. A notable advantage is that since payments are encrypted, the commands' content is hidden, and the mere fact that these payments act as a C2 mechanism is obfuscated. Previous work, cited in last week's paper, explored different topologies that attackers could adopt for the Lightning channels connecting their botnet. This new paper moves these approaches from simulations to a regtest network with varying numbers of nodes, and tests how different topologies behave in terms of propagation speed and resilience.

Of course, I think using Lightning channels as a C2 transport mechanism is a bit impractical, but as the network grows it could become a more interesting medium. It's also worth noting that while using payments to transfer messages is fairly private, using the gossip layer could (maybe?) achieve a comparable outcome without requiring machines in the botnet to open actual channels!

StackerNews Discussion

Bark

Bark, Second's Ark implementation, went live on mainnet last week! On top of this announcement itself, two things that caught my eye are:

• multiple vulnerabilities were quickly caught post-release (notably by floppy and Greg Sanders). These vulnerabilities were privately disclosed and quickly fixed ;
• the Second team also published an Umbrel/Start9 app, which basically ships the bark daemon (barkd) with a web interface, and lets users send and receive through Ark, Lightning and on-chain. Of course, Lightning transactions via barkd go through a Lightning gateway, removing the need for managing channels ; but at the same time implying new trust requirements towards the Ark server (which also serves as the Lightning gateway). To me, users who go the extra mile of running their own node (with Umbrel or Start9 for example) would typically also open their own channel(s), potentially with big hubs if they don't want to spend hours finding the perfect peer, and thus retain complete self-custody. But at the same time, always-on barkd clients are best-positioned to provide an Ark experience that is as trustless as possible, with easy participation in refreshing rounds and no need for signature delegation.

Quick Strikes

• Alby Hub's latest release brings Just-in-Time channels support to users running LDK backends, adds Bark as a new backend option (beta) and puts forth a marketplace of Lightning top-up debit cards, all rechargeable through NWC ;
• Dusty did the first known splice-out into a channel open on a regtest.

---

That's it for today! Thank you so much for reading this far, and until next week!

https://stacker.news/items/1511938