LNTest: A Testbed for Evaluating Bitcoin Lightning Network-Based Botnets

2026-06-11

AI Summary

This study addresses the lack of empirical evaluation on Bitcoin Lightning Network (LN)-based botnets regarding their real-world topology formation, command propagation complexity, and resilience to takedown strategies. To bridge this gap, we present LNTest—the first reusable testbed for LN botnets—built upon Dockerized Core Lightning nodes operating on a Bitcoin Core regtest chain, supporting deterministic chain, autonomous discovery, and user-defined overlay topologies. Our experiments reveal, for the first time, that D-LNBot naturally forms clustered chain-like structures in practice. We correct the command propagation complexity from the previously assumed O(m log n) to Θ(n) and systematically quantify the robustness of different topologies against both targeted and random node removal. Notably, the autonomously formed clustered chain exhibits the highest vulnerability among all evaluated configurations.

Abstract

Bitcoin's Lightning Network (LN) can be exploited as a covert, low-cost command-and-control (C&C) channel for botnets, as demonstrated by the LNBot and D-LNBot designs. However, both remain proof-of-concept prototypes evaluated only through simulation, leaving key questions about real-world topology formation, propagation complexity, and resilience to takedowns unanswered. We present LNTest, the first reusable testbed for LN-based botnets, built from Core Lightning nodes containerized with Docker over a shared Bitcoin Core regtest chain. LNTest supports three overlay topology modes (a deterministic chain, autonomous peer discovery, and user-supplied graphs), enabling controlled experiments across different botnet structures. Using LNTest, we report three main findings. First, D-LNBot's autonomous formation protocol does not produce the uniform chain from its design; instead, it creates a clustered chain in which cliques are linked by bridge nodes whose removal fragments the network. Second, command propagation scales linearly with botnet size ($Θ(n)$), not the $O(m \log n)$ previously claimed, and gains nothing from higher neighbor connectivity. Third, the overlay topology determines the effectiveness of takedown strategies: uniform-degree chains resist targeted removal but fragment under random failure, scale-free topologies show the opposite pattern, and the autonomous clustered chain is fragile under both, making it the most vulnerable of the three. LNTest is released as open source, with a script that reproduces all our experiments, to support reproducible research on LN-based botnet defenses.

Problem

• Lightning Network
• botnet
• command-and-control
• topology formation
• resilience

Innovation

• Lightning Network
• botnet testbed
• command-and-control
• overlay topology
• network resilience