Critical Bitcoin Lightning Bugs Exposed to Fund Theft and Restart Failure

CryptoSlate's Lightning Development Kit (LDK) released v0.2.6 on September 9, addressing critical bugs in Bitcoin's Lightning network.

The update fixes a splice-related fund loss and payment-handling flaw that could prevent saved channel state from loading.

A malicious peer could divert small amounts through excess fee allocation by initiating a splice, affecting how much of the node's money pays for the operation.

The second security flaw involved two payment contracts sharing the same payment hash. Receiving and immediately rejecting a bogus payment could leave ChannelManager state unable to load.