Seres Istvan [@Istvan_A_Seres] explains that the attacker wants to find the edges of the graph of Bitcoin Lightning Network nodes. The researchers discovered roughly 30% of all non-announced private channels. Private channels can be discovered by the Bitcoin script used in channel closing transactions, or by analysing the peeling chain of subsequent channel openings of the same node.
https://arxiv.org/pdf/2003.12470.pdf
https://arxiv.org/pdf/2007.00764.pdf
https://arxiv.org/pdf/2004.00333.pdf
https://arxiv.org/pdf/1911.09432.pdf
