Lightning Network (Part 5) – BitMEX Research Launches Penalty Transaction Alert System

Abstract: ForkMonitor has launched a Lightning Network penalty transaction alert system, available at Unfortunately, it is possible the alerts could be manipulated, for instance by users artificially generating this transaction type on two nodes they control. On the other hand, our new alert system should capture every failed theft attempt on the Lightning Network, in real time. This may be a useful feature to those monitoring the health and development of the Lightning Network and additionally it could be useful to individual users concerned about their channels.



In July 2019, we published our third report on the Lightning Network, which explained that there are four different ways lightning channels can be closed. We mentioned justice transactions (AKA penalty transactions), the closure type in which an honest node sweeps away all the funds inside a channel, after an attempted theft from a dishonest party. Of all the economic channel closure types, this is only one that is easily detectable when monitoring the blockchain. Therefore, we have implemented an alert system, which tracks all penalty transactions in real time and provides information about them, such as the value of bitcoin claimed by the honest node.

Just like the other alerts on ForkMonitor, the penalty transaction alerts are available on an RSS feed, which can be found here.

(Screenshot from, which shows a list of all the penalty transactions)

The Lightning User Claiming To Have Lost 4 BTC

Back in October 2019, Reddit user /u/ZipoTm claimed to have lost around 4 bitcoin while using Lightning. This was reported on by some media outlets. The Redditor was said to have non-cooperatively closed channels using an old state, which triggered penalty transactions from those on the other side of the channels, resulting in a large 4 bitcoin loss.

This then led to speculation in the Lightning community as to whether the loss was genuine or if the loss really occurred in the way the /u/ZipoTm claimed. Eventually Lightning developer Rusty Russell scanned the Bitcoin blockchain for such penalty transactions in the relevant period and he did not find transactions as large as 4 BTC.

As it turns out, the user did not lose 4 bitcoins and was able to recover most of the funds in the end. 

Going forwards, our penalty transaction alert system could be used to assess the authenticity of such claims in real time.

Manipulation Of The Penalty Alerts Are Possible

Penalty transactions do not necessarily reflect a genuine attempt at theft. Indeed, as we explained in our July 2019 report on the topic, one could have two lightning nodes and manually create a penalty transaction against oneself. The penalty transactions could also be caused by accident, for example resulting from data loss. Therefore, the alerts and data reported by our service should be treated with a degree of caution.

While each alert does not necessarily indicate a punishment for a genuine theft attempt, the reverse should be true. Every single failed theft attempt on the Lightning Network, attempted by publishing an earlier channel state, should be captured by ForkMonitor’s penalty transaction alert system.

Updated Penalty Transaction Data

Below we provide updated charts which show data about all the penalty transactions since 2017. The data is compared to a Bitcoin feerate estimate (provided by, to help determine if the penalties were caused by spikes in the feerate. At least for now this appears not be the case, with the possible exception of September 2018.

Daily Penalty Transaction count vs Bitcoin Feerate

(Source: BitMEX Research,

Daily Penalty Transaction value vs Bitcoin Feerate

(Source: BitMEX Research,