Lightning Labs discloses bug that marked canceled Bitcoin payments as settled

Lightning Labs has disclosed a bug that could make a canceled Bitcoin Lightning payment appear as “paid” on a merchant’s invoice, opening the door to goods or credit being handed over for free. The flaw sat in older builds of Lightning Terminal, the company’s bundled software for running lnd and Taproot Assets together, and the relevant code was actually patched more than a year before the public advisory.

• Lightning Labs disclosed the bug on Sept. 21, 2026, but gave no count of actual merchant losses.
• The flaw combined a separate defect in tapd and one in lnd, and did not require the merchant to run any Taproot Asset channels.
• Fixes shipped in tapd v0.5.1 on Feb. 12, 2025 and lnd v0.19.0-beta on May 22, 2025, well before the September 2026 disclosure.

• 9/21/26 date Lightning Labs disclosed the invoice-status bug publicly
• 2/12/25 date tapd v0.5.1 patched the triggering forwarding rule
• 5/22/25 date lnd v0.19.0-beta fixed the invoice accounting error
• v0.15.0 first Terminal alpha release bundling fixes for both defects

A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice as paid even after the underlying payment was canceled and returned to the sender, according to reporting by CryptoSlate. Lightning Labs disclosed the defect on Sept. 21, 2026, warning that merchants relying on invoice status could release goods or credit without ever receiving funds. The company detailed the mechanism behind the bug but did not disclose how many merchants, if any, suffered actual losses.

Canceled payment, invoice still marked “settled”

The core defect was a mismatch between a Lightning Terminal invoice’s recorded status and what actually happened to the underlying payment, according to the security advisory. A Lightning payment moves through a hashed time-locked contract, or HTLC, which carries funds between nodes until it either settles or is canceled. In the flawed setup, the HTLC was canceled on the network and its funds returned to the sender, while the receiving node’s software still logged the invoice as settled.

A merchant relying on that status alone could ship goods or extend credit for a payment that had already been returned.

Lightning Labs said the advisory does not describe any failure of Bitcoin’s base chain. The bug lived entirely in the software layer sitting above it.

Two separate bugs in tapd and lnd combined to trigger the flaw

Lightning Terminal bundles tapd, the software that runs Taproot Assets, together with the lnd Lightning node. In affected setups, tapd enabled its invoice interceptor and treated any HTLC carrying custom wire records as an asset payment, even when no assets were actually involved.

Some sender implementations added an experimental endorsement record to ordinary bitcoin payments, tripping tapd’s strict-forwarding rule and instructing lnd to cancel the HTLC set. Lightning Labs noted the trigger did not require the merchant to have any open asset channels, meaning operators running plain Bitcoin Lightning nodes with no Taproot Assets activity could still be exposed.

A second, separate defect sat inside lnd itself. When an interceptor canceled the HTLC set, affected versions of lnd canceled the payment on the network but still marked the corresponding invoice as settled in its own database, an error Lightning Labs said could recur in any other client using lnd’s HtlcModifier interface to cancel HTLCs. The company rated the combined vulnerability high severity, because a false “paid” status could lead a merchant, operator or payment service to release value against a payment that never completed; according to the advisory, the sender’s funds were not at risk at any point.

Patches shipped in 2025, more than a year before the disclosure

The fixes for both defects were already in circulation well before Lightning Labs published its advisory. The tapd trigger was patched in Taproot Assets v0.5.1 on Feb. 12, 2025, while the underlying lnd accounting bug was fixed separately in lnd v0.19.0-beta on May 22, 2025.

Terminal v0.14.1-alpha already contained the tapd-side fix, but its bundled version of lnd still carried the invoice-state defect, leaving that release only partially remediated. Lightning Terminal v0.15.0-alpha is the first release to bundle fixes for both defects together. Lightning Labs lists the affected range as earlier Terminal versions, Taproot Assets through v0.5.0, and lnd 0.18.4-beta through 0.18.5-beta.

The September 2026 advisory disclosed a vulnerability whose relevant fixes had already shipped more than a year earlier, in 2025.

For operators who cannot update immediately and run no asset channels, Lightning Labs suggests launching lnd with the flag –taproot-assets-mode=disable to avoid the tapd trigger observed in practice.

The BlockWest read. We read this as a patch-management failure more than a protocol flaw. Any operator still running Lightning Terminal tied to lnd 0.18.4-beta through 0.18.5-beta has carried the exposure since before Lightning Labs shipped the underlying fixes in 2025. The advisory itself arrived more than a year after those patches landed, which tells us monitoring for silent invoice-state bugs, not just chasing headline CVEs, needs to become routine for anyone accepting Lightning payments commercially.

Lightning Labs has not said how many Terminal operators remain on the vulnerable lnd 0.18.4-beta through 0.18.5-beta range, and the company has given no timeline for disclosing whether any merchant actually lost funds before the 2025 patches were widely adopted.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.