The Lightning Network is defined by a set of specifications called BOLTs (Basis of Lightning Technology). Here is what happens under the hood.
Opening a channel (BOLT 2 and 3)
Two peers create a funding transaction paying to a 2-of-2 multisig output (P2WSH; some implementations also offer experimental Taproot channels). Before broadcasting it, they exchange signatures for the first commitment transactions, so each can recover their money if the other disappears.
Commitment transactions
Each side holds its own, signed by the other side, which pays out the current balance. Every payment creates a new pair. The output that pays the holder is delayed by a relative timelock (to_self_delay, using CSV).
Revocation: why cheating fails
When moving to a new state, each side hands over a revocation secret for its old commitment. If someone broadcasts an old state, the other side has a window while the delay runs to use the revocation key and take all of the channel's funds. You must watch the chain, or use a watchtower.
HTLCs: payments across hops
The receiver creates a secret preimage and puts its SHA-256 hash in the invoice (BOLT 11). The sender's payment travels as a chain of HTLCs, each one saying "pay if you show the preimage before block height X". Every hop forwards a slightly smaller HTLC with an earlier expiry. The difference, cltv_expiry_delta, gives each node time to claim upstream after being paid downstream. When the receiver reveals the preimage, it flows back along the route and each hop settles.
Onion routing (BOLT 4)
The sender picks the whole route and wraps instructions in layered encryption (Sphinx). Each hop peels one layer and learns only the previous and next hop. The onion packet has a fixed size of 1,300 bytes for hop payloads, so a node cannot tell how far it is from the end.
Closing
A cooperative close is a single transaction with no delays. A force close broadcasts the latest commitment and waits for the timelock, and any pending HTLCs are resolved on-chain.
Open problems
Liquidity management, fee spikes during force closes (addressed with anchor outputs and package relay), and privacy limits around routing remain active research.