I have decided to close my lightning channels and for the time being will only be accepting on-chain bitcoin until I can improve my hardware and knowledge.
Like most of us, I'm sure, I've been thinking about my bitcoin security heavily this last week. Yesterday, I was poking around my BTCPay server at the exact same time I saw the critical warning from
@calle Great timing, I thought, so I immediately updated. However, some of you may know that I set my btcpay up on a raspberry pi 3... I thought it was important that bitcoin products are capable of running on cheap accessible hardware. The initial set up took MONTHS of block downloading, but I was patient and determined.
After the update yesterday my hardware was resyncing at about 1 block every 5-7 minutes. In the hour after updating 16 blocks were found and I was falling behind. At the same time a thunderstorm was raging out my window and I didn't know what was vulnerable or how exposed I was... so I took my seed and attempted to open the wallet with sparrow. I confirmed the seed, the master fingerprint and the derivation path yet nothing was showing up. I tried a few times and still don't know why this failed. So, I waited.
The node synced. Finally I was at the tip of the chain and NBXplorer was close to caught up as well. Then the power blinked and my heart sank. Resyncing started again. Twenty minutes later the power drops off for 15 minutes. When the power came back I saw that my node was back to where it was when I did the initial update four hours before! At 5-7 minutes per block I knew it would be all night until I was caught up so I went to bed stressed.
Thankfully, this morning I was able to close channels and move all of my funds.
Looking back there are some big takeaways for me from this event.
1) Do not try to be cute with your hardware. Use the best products that you can afford.
2) Test your backups when setting up a system. I still don't know why I couldn't recover from sparrow with the correct seed, derivation path, and fingerprint.
3) Understand how your software updates and interacts with connected software. (After I updated BTCPay server the associated RTL did not update and was still v 0.15.10-beta !!) So as far as I can tell I slowed myself down 12+ hours in an active attack and didn't do anything to protect the actual vulnerable part of the stack.
My heart goes out to everybody affected by the recent attacks and I am confident we'll come through this stronger and more secure. I'm looking forward to the day that I announce I am once again on the lightning network. Third times the charm, right?
