Chainalysis New Service: Snitching For The Lightning Network. Can They Deliver?

In a recent press release, blockchain monitoring firm Chainalysis promises “a transaction monitoring solution for the Lightning Network.” The biggest snitches in the game had been left out of Bitcoin’s latest evolutionary step. Can Chainalysis really monitor the Lightning Network or is this an empty threat? Let’s take a page from their book and analyze their statement, there are probably clues in there.

In the intro, they promise, “Chainalysis will enable our customers to process Lightning transactions at the same level of security and compliance as blockchain transactions.” What do they mean by “process”? What are they saying there exactly? We’re not sure, but the press release starts by giving out public stats about the Lightning Network’s growth.

“As of December 1, 2021, just under 3,600 BTC worth over $205 million is locked in public Lightning Network channels, up from 468 BTC worth roughly $4.8 million on January 1, 2021. The number of open lightning channels has also increased substantially over time. On Dec 1, 2021, there were over 90,000 open public Lightning channels, up from over 38,000 in January.”

Chainalysis Deep Dive Into The Lightning Network
Each transaction that opens and closes Lightning channels does get recorded forever on the blockchain. What goes on between the parties involved in the meantime, that’s still a mystery to blockchain analysis companies. This first, probably exploratory, study that Chainalysis gives its prospective clients just covers what happens on the main chain, Bitcoin’s first layer.

“If all the funds go to one user, there will be one transaction output when the channel is closed. This could mean that the user funding the channel sent all the original funds to the channel’s second user across a series of transactions, but more often than not it means the channel was simply never used. If funds exit through two transaction outputs, that means both users of the channel ended up with a positive balance following all of the Lightning transactions that occurred, suggesting that they actively used the channel to transact.”

Notice the speculation. Even at the first layer level, they have to rely on wild guesses.

What Does Chainalysis Promise?
Without doing any analysis of the Lightning Network so far, the company goes all-in.

“In the beginning of next year we will be introducing Lightning Network transaction monitoring to Chainalysis KYT, the world’s leading cryptocurrency transaction monitoring software. Our customers will be able to use KYT to monitor their Lighting Network transactions, screen for risky activity, and gain valuable insights.”

How will they do it, though? The community seems skeptical… you’ll have to go into Twitter’s hidden replies to notice that, however. Chainalysis worked very hard to not allow discusions under their announcement tweet.

Among the replies, we find the most common objections to Chainalysis’ plan. For example: “You are trying to help authoritarian states. But are going to fail with lightning – no one is going to connect to you.” And also, “Why would anyone connect with a surveillance firm?” Plus this, “Please announce your nodes, so we can all avoid routing through you and close any channels you are opening with us. Thank you.” However, according to this pseudonymous user, there’s still hope for Chainalysis. “That isn’t necessary. They may need only to capture the hubs in the network like they did on-chain.”

So, we’ll see.

The Lightning Network’s Known Vulnerabilities
There are a couple of attack vectors that snitching firm Chainalysis could still use. Of course, Bitcoinist already covered them.

“According to Shinobi, if you control several nodes you could potentially learn a lot from the payments that go through them. “Firstly there is the decrementing timelocks. This allows me to guess both how many hops away the first node I run involved in the payment is from the origin point as well as how many hops away from the destination the last node I run that is involved is.”

However, for this to be a problem, Chainalysis’ nodes would have to be anonymous. Nobody is going to connect to them otherwise. There’s another known vulnerability that’s even more insidious.

“An adversarial actor could figure out how much Bitcoin a channel holds by constantly probing them. “Taking regular snapshots like this would allow you to start playing summing games in global channel balance shifts and guessing at payment flows.”


So, there are actions Chainalysis can take to ruin the party and report all activities to the school’s principal. However, they would have to provide liquidity to the Lightning Network first. Then, connect to others in an incognito way. And lastly, perform their nefarious monitoring activities without getting caught. Chainalysis will do it for everyone’s benefit, though. Trust them.