Lightning as a blind spot: what the chain reveals about channels, and what it does not

The Lightning Network is the layer where Bitcoin becomes fast and cheap. For forensics it is also the layer where the blockchain falls silent. A case from our daily work shows how much it still says.

The case

A wallet opens a channel and puts just over 1 BTC into it. About one day and 145 blocks later the channel is closed cooperatively. The closing transaction has two recipients: the original wallet receives 0.042 BTC back, the counterparty 0.959 BTC. On chain there is nothing in between. No payment, no recipient address, no timestamp. The wallet takes the remainder, opens the next channel with it, and the cycle starts again. We saw several such rounds in the same chain of transactions, each closing remainder became the funding of the next channel.

To an investigator who only counts transactions this looks like a wallet shuffling its money between multisig addresses and shrinking along the way. In reality Lightning serves here as a transfer rail: the value went into the channel, was routed through the network to another destination, and what fell to the counterparty at closing is the balance of those payments.

What is on the chain

On chain a Lightning channel consists of exactly two events. The opening is a transaction that places bitcoin into an output that only both channel partners together can spend. The closing is the transaction that spends this output again and pays out the balances of both sides. In a cooperative close these are usually two outputs, one per party. In a forced close, time locks and further outputs are added, which reveal who triggered the closure.

Nothing more is there. Which payments flowed through the channel, how many, when, to whom, all of that stays off chain. Anyone searching the blockchain for the path of the 0.959 BTC will not find it, because it was never there.

What the network reveals

Lightning has a second data source that is often overlooked. Public channels are announced through the gossip protocol: every node in the network learns which two nodes operate a channel, with what capacity and which funding output it refers to. These announcements are no secret, they are the precondition for the network being able to route payments at all. Nodes carry names, and many of them recognisably belong to services: payment processors, wallet providers, exchanges, large routing operators.

This makes it possible to attribute a closing transaction, which on chain shows only two addresses, to a channel between two named nodes. In the case above the counterparty was a large routing hub. So the wallet did not pay an unknown party, it forwarded its money through the infrastructure of a known operator. Where it went from there, gossip does not say either. But the edge of the blind spot is now named, on both sides.

Private channels are not announced. They are still recognisable on chain, because opening and closing follow fixed patterns, only the name of the counterparty is missing. That too is information: someone who uses exclusively private channels to changing partners behaves differently from a user who connects their wallet to a service.

What this means in practice

Lightning does not hide the money trail, it moves it. The chain shows beginning and end, the network shows the participants, the path in between stays dark. Anyone who reads Lightning transactions as ordinary multisig movements draws wrong conclusions: they add up amounts that never stayed with the wallet, or they miss that an outflow took place.

The closing is the more important edge. The opening reveals who put money into the channel. The closing reveals how it was distributed, and with the counterparty's output it leads into their wallet. That is where the remainders of many channels accumulate, and that is where attribution to an operator begins.

Channel chains are a behavioural pattern. A wallet that puts closing remainder after closing remainder into new channels uses Lightning as an exit, not as a means of everyday payment. That is not proof of anything, but it is a finding a report should name.

In Coinator, openings and closings appear in the transaction graph marked as such, with the channel endpoints from the gossip network where the channel was public, and with a jump to the respective partner transaction. Whoever is looking at a closing sees the opening with one click, and vice versa. The blind spot remains, but it has edges, and those can be analysed.