I'm not filing a bug in the traditional sense. I'm filing what should be a wake-up call, because I've now watched this exact failure destroy money for at least two people (myself included) in the span of a single week, in a single Telegram thread, and I have no reason to believe those are the only two.
What happened:
Umbrel-hosted Core Lightning node. At some point the hsm_secret loaded by the daemon stopped matching the node_id recorded in lightningd.sqlite3. The daemon refuses to start:
BROKEN wallet: Wallet node_id does not match HSM:
<node_id_A> != <node_id_B>
Did your hsm_secret change?
lightningd: Wallet sanity check failed.
I do not have a copy of the original hsm_secret that matches the wallet database. It's gone. There is no seed phrase to fall back on, because none exists. The result is total, silent, permanent loss of on-chain wallet funds — not a small amount, not "test funds," real savings.
Why I'm filing this instead of just walking away:
Because the honest answer to "how do I get my money back" from everyone I've asked — community members, docs, this very project's own support channels — has been some version of "you needed the exact original hsm_secret, and if you don't have it, there is nothing anyone can do." That's not a support gap. That's a fundamental design failure in a piece of software whose entire job is safeguarding money.
The actual ask:
hsm_secret should not be a raw, unverifiable 32-byte binary with no human-readable backup. Every serious Bitcoin wallet solved this a decade ago with BIP39. Core Lightning is one of the only pieces of software in this ecosystem still handling key material like it's 2015.
Platforms that package and distribute this to non-technical users (Umbrel being the obvious example) currently do not force or even clearly prompt users to back up this file at setup — while backing up everything else (app configs, gossip caches, literally free-to-redownload apps) by default. The one file that represents real, irreplaceable money is the one thing nobody is forced to protect.
I'm asking, plainly: is a move to BIP39-style seed generation for hsm_secret something the maintainers are actually considering, or is this permanently going to be "the user's problem" for anyone who isn't already a Bitcoin core dev?
I don't need sympathy in this thread. I need this tracked as a real, open, technical failure — because right now the burden of a catastrophic design decision falls 100% on people who trusted the "self-custody made easy" pitch, and 0% on the people who built the system that made it this easy to lose everything without a trace.
I'm not filing a bug in the traditional sense. I'm filing what should be a wake-up call, because I've now watched this exact failure destroy money for at least two people (myself included) in the span of a single week, in a single Telegram thread, and I have no reason to believe those are the only two.
What happened:
Umbrel-hosted Core Lightning node. At some point the hsm_secret loaded by the daemon stopped matching the node_id recorded in lightningd.sqlite3. The daemon refuses to start:
I do not have a copy of the original hsm_secret that matches the wallet database. It's gone. There is no seed phrase to fall back on, because none exists. The result is total, silent, permanent loss of on-chain wallet funds — not a small amount, not "test funds," real savings.
Why I'm filing this instead of just walking away:
Because the honest answer to "how do I get my money back" from everyone I've asked — community members, docs, this very project's own support channels — has been some version of "you needed the exact original hsm_secret, and if you don't have it, there is nothing anyone can do." That's not a support gap. That's a fundamental design failure in a piece of software whose entire job is safeguarding money.
The actual ask:
hsm_secret should not be a raw, unverifiable 32-byte binary with no human-readable backup. Every serious Bitcoin wallet solved this a decade ago with BIP39. Core Lightning is one of the only pieces of software in this ecosystem still handling key material like it's 2015.
Platforms that package and distribute this to non-technical users (Umbrel being the obvious example) currently do not force or even clearly prompt users to back up this file at setup — while backing up everything else (app configs, gossip caches, literally free-to-redownload apps) by default. The one file that represents real, irreplaceable money is the one thing nobody is forced to protect.
I'm asking, plainly: is a move to BIP39-style seed generation for hsm_secret something the maintainers are actually considering, or is this permanently going to be "the user's problem" for anyone who isn't already a Bitcoin core dev?
I don't need sympathy in this thread. I need this tracked as a real, open, technical failure — because right now the burden of a catastrophic design decision falls 100% on people who trusted the "self-custody made easy" pitch, and 0% on the people who built the system that made it this easy to lose everything without a trace.