Lightning Labs Patched Invoice Vulnerability
The software flaw allowed merchants to inadvertently release goods for canceled payments.
Updated on Sept. 25, 2026 in Software
Live Poll
Do you trust software providers to be transparent about the financial risks caused by their bugs?
Lightning Labs disclosed a high-severity vulnerability that erroneously marked canceled invoices as paid within Lightning Terminal, tapd, and lnd software. This flaw risked merchant losses by signaling successful transactions without actual receipt of funds.
Why it matters
The incident highlights risks inherent in synchronization between invoice records and payment outcomes within complex off-chain networks. While Bitcoin’s base layer remained secure, the flaw threatened merchant workflows that rely on accurate payment confirmation.
The bug affected lnd (Lightning Network Daemon) versions 0.18.4-beta through 0.18.5-beta and tapd versions up to v0.5.0, with fixes arriving in v0.19.0-beta and v0.5.1 respectively.
The players
Lightning Labs
A developer of infrastructure for the Bitcoin Lightning Network, focusing on scaling solutions and layer-two software stacks.
The details
The vulnerability occurred when the tapd invoice interceptor—a software component that captures and validates payment requests—incorrectly identified HTLCs (Hashed Time-Locked Contracts, which ensure payments only settle if specific conditions are met) with custom wire records as asset payments. Simultaneously, the lnd software canceled the payment on the network but erroneously marked the associated invoice as settled in the internal database. This mismatch led merchants to believe funds had been received when the transaction had actually failed.
Timeline
Feb. 12, 2025: The tapd trigger was resolved.
May 22, 2025: The lnd accounting error was patched.
Sept. 21, 2026: Lightning Labs publicly disclosed the vulnerability.
The Tech Race
This incident serves as a reminder of the security challenges facing non-custodial layer-two software. It highlights the ongoing race to harden infrastructure against logic-based vulnerabilities as developers balance complex new features like taproot assets with rigorous accounting reliability.
Merchants using affected versions of lnd or tapd must update to Lightning Terminal v0.15.0-alpha to ensure invoice integrity. Those failing to apply these patches remain susceptible to payment reconciliation errors where canceled transactions appear settled.
The takeaway
The vulnerability demonstrates that while base-layer security is robust, application-level software requires careful auditing to prevent reconciliation failures. Users should verify their software version against the patched release list to ensure payment records reflect actual chain state.
Further reading
For more on the latest developments in Bitcoin infrastructure, visit Software.
Live Poll
Do you trust software providers to be transparent about the financial risks caused by their bugs?
