Key points

  • A two-part software defect could cancel a Lightning payment on the network while recording the receiving invoice as settled.
  • Lightning Terminal before v0.15.0-alpha and specific older tapd and lnd versions are affected; patched versions shipped in 2025.
  • The flaw could expose merchants to unpaid deliveries, but it did not put the sender's returned funds or Bitcoin's base layer at risk.

Lightning Labs has disclosed a high-severity software flaw that could make a canceled Bitcoin Lightning payment look completed inside a merchant's system. In the affected setup, the payment was returned to the sender on the network, but the receiving node's invoice database still showed it as settled. A merchant or automated service trusting that status could therefore release goods, credit or account access without receiving the payment.

Two defects created one false signal

The September 21 advisory traces the mismatch to two defects operating together. Lightning Terminal combines lnd, Lightning Labs' node implementation, with tapd, its Taproot Assets software. Tapd's invoice interceptor incorrectly treated any hashed time-locked contract carrying custom wire records as an asset payment. Some sender software attached an experimental endorsement record to ordinary Bitcoin payments, triggering tapd's strict-forwarding logic even when the merchant had no asset channels open.

Related reporting: Quantum researchers cut key Bitcoin attack benchmark by 86%

Tapd then instructed lnd to cancel the payment's HTLC set. Lnd returned the funds on the wire as intended, but affected versions still changed the associated invoice to settled in the database. Lightning Labs said the lnd defect was broader than tapd: another client using the HtlcModifier interface to cancel an HTLC set could have produced the same accounting mismatch.

Affected versions and fixes

The advisory lists Taproot Assets through v0.5.0, lnd v0.18.4-beta through v0.18.5-beta and Lightning Terminal releases before v0.15.0-alpha as affected. Tapd v0.5.1 corrected the observed trigger in February 2025, while lnd v0.19.0-beta fixed the underlying invoice-state error in May 2025. Lightning Terminal v0.15.0-alpha bundles versions with both fixes.

That sequence matters for operators on intermediate releases. Lightning Terminal v0.14.1-alpha contained the tapd fix, but its bundled lnd version still carried the separate accounting defect. Lightning Labs says both fixes are required for full protection. Operators who cannot upgrade and do not use asset channels can disable Taproot Assets mode to avoid the observed tapd trigger, though upgrading is the more complete remedy.

Merchant risk, not a base-layer failure

The company rates the issue T1 High under its own severity system because the false settled status could cause a real loss for each affected invoice. However, the advisory does not describe a theft of the sender's Bitcoin, a failure of Bitcoin's base chain or a general break in Lightning payments. The canceled HTLC was correctly returned; the receiving software's record of the outcome was wrong.

Lightning Labs identified the issue from a field report on January 27, 2025, shipped the fixes that year and published the full advisory in September 2026. Independent reporting on September 25 highlighted the remaining exposure for installations that have not been updated. Neither the advisory nor the report provides a total for actual merchant losses, so the financial impact beyond the demonstrated risk remains unknown.

What operators should verify

Businesses running Lightning Terminal, tapd or custom software built on lnd's HtlcModifier interface should confirm the exact versions in production rather than relying only on a dashboard's apparent payment state. They should also test fulfillment workflows after upgrades and monitor for discrepancies between invoices and payment outcomes. The episode is a reminder that invoice status is an application-layer accounting signal: when software releases value automatically, that signal must stay consistent with the network result.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.