The primary advantage of such nodes is the considerable increase in difficulty for attackers to perform specific types of attacks due to the nodes' reduced visibility and interaction with the network. Non-listening nodes do not actively seek incoming connections, challenging malicious entities to locate and exploit them. This method aligns with a conservative security approach that emphasizes reducing attack surfaces by limiting exposure to essential network activities. By doing so, these nodes avoid unnecessary risks associated with open ports and services.

A security vulnerability identified in May 2021 exposed a risk in versions of Bitcoin Core software prior to v22.0. The vulnerability was related to how bitcoind selected peers for compact block relay and could be exploited using the function PeerManagerImpl::MaybeSetPeerAsAnnouncingHeaderAndIDs. An attacker could potentially manipulate peer selection by supplying blocks faster than honest nodes and interfere with the mapBlocksInFlight mechanism, which expected a node to respond with a requested block within about 10 minutes. The exploit allowed an attacker to make multiple connections during the setup phase, undermining the peer eviction process with AttemptToEvictConnection. The methodology behind this attack involved replacing a victim's compact block connections with those controlled by the attacker, creating additional malicious connections, and manipulating block relay through timely disconnections or sending invalid blocks.

These vulnerabilities posed a significant threat to the Lightning Network (LN), especially concerning channels with specific CLTV delta times for Hash Time-Locked Contracts (HTLCs). Attackers could force close transactions and claim HTLCs by delaying block delivery to intermediate nodes, which could lead to the theft of the value contained in an HTLC.

To address these issues, two pull requests were integrated into the Bitcoin Core v22.0 release. First, PR22144 introduced randomization in message processing order to preserve at least one honest peer among malicious ones. Second, PR22147 prevented inbound attackers from demoting the last outbound high-bandwidth compact-block relaying peer. These patches significantly enhance the network's defense against such sophisticated attacks, highlighting the importance for operators, particularly those running lightning nodes, to upgrade their software to ensure continued security and risk mitigation.