Lightning Labs disclosed on September 21, 2026 a critical flaw in older Lightning Terminal versions that could mark canceled Bitcoin payments as settled after funds were returned to the sender. A merchant trusting that false invoice status could release goods or credit without receiving payment. The vulnerability stemmed from two distinct software defects, one in tapd and one in lnd, both fixed in 2025. Actual merchant losses remain undisclosed while outdated installations stay exposed to the risk.
Source: Read the original article
