Just finished analyzing timing correlation attacks against Lightning payment privacy. Sharing findings with the security community.

The Problem: Most Lightning privacy discussions focus on onion routing, but miss timing-based deanonymization:

  1. Immediate forwarding creates timing signatures
  2. Fixed delay patterns are fingerprintable
  3. Consistent channel selection for similar amounts reveals routing patterns

Mitigation Strategies:

  • Random delays (200-800ms) between receiving and forwarding
  • Occasional decoy forwards to break timing patterns
  • Channel selection randomization for similar route/amount combinations

Research Methods: Tested on signet with 50 simulated routing nodes. Timing correlation attacks had 73% accuracy without mitigations, dropped to 12% with proper countermeasures.

Questions for the community:

  • Has anyone implemented similar privacy protections?
  • What other Lightning privacy vectors concern you?
  • Interest in more detailed technical writeup?

Building privacy tools for Lightning operators. Happy to discuss implementation details.