Who Patches the Lightning Network? Evidence from Release Lines in Gossip, 2023-2026

Every implementation of Bitcoin’s Lightning payment network disclosed security vulnerabilities in 2026, and every advisory told operators to upgrade. Whether they do has never been measured, because Lightning gossip carries no software version. Matching the feature bits a node announces against the source of every LND, Core Lightning, Eclair and LDK release, we show that gossip reveals a node’s release line after all. Where Core Lightning nodes state their version, the inferred line is exact for 132 of 136 node-line pairs. Across 814 daily snapshots of the public graph from 2023 to 2026, the network patches on release and platform schedules, not on disclosures. Half of LND nodes upgrade within 88 days of a release; small nodes and those that skipped releases lag far behind. The three largest upgrade waves came about a day after the Umbrel app store shipped a new LND version. Since June 2025, 17% of LND upgrades came in the 48 hours after a platform release, windows that cover 4.4% of the time. Disclosures, a median 256 days after the fix, moved few operators: of 12 we can test, only Core Lightning’s of July 2026 sped up upgrades, and only among nodes one release line behind. Its later call to restart offline was followed mostly by nodes already patched. Two months after Lightning Labs’ August 2026 batch, 71% of the LND nodes exposed at disclosure still ran an affected release. For maintainers, the lever on the nodes that lag is the platforms that package their releases.