Critical Bug Discovered in Older Lightning Terminal Versions
Lightning Labs has disclosed a critical bug in older versions of Lightning Terminal that could mark canceled Bitcoin payments as paid, putting merchants at risk of releasing value without receiving funds.
The issue occurred when a hashed time-locked contract (HTLC) was canceled on the network and returned to the sender, while the receiving node still recorded the invoice as settled. This mismatch between the software's invoice record and the payment's outcome could lead an operator or payment service to release value against a payment that never completed.
Lightning Labs patched the flaw in versions of Lightning Terminal released before September 2026, but older installations remain exposed. The company rates the vulnerability as high severity due to its potential impact on merchants.