Lightning Terminal software flaw could falsely mark Bitcoin payments as paid after cancellation
Quick Look
- A vulnerability in older Lightning Terminal software could incorrectly record Bitcoin Lightning invoices as paid after payments were canceled and returned to senders, potentially leading merchants to release goods or credit without receiving funds, Lightning Labs disclosed on Sept.
- 21, 2026; fixes were shipped prior to disclosure.
AI-generated summary
Why It Matters
Lightning Terminal is a software bundle that includes tapd for Taproot Assets and the lnd Lightning node, used for processing Bitcoin Lightning Network payments.
A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice paid after the payment was cancelled and returned to its sender, Lightning Labs disclosed on Sept. 21, 2026.
A merchant relying on that invoice status could release goods or credit without receiving funds. The company describes that risk but gives no tally of actual merchant losses.
The issue was a mismatch between the software's invoice record and the payment's outcome. A Lightning payment uses a hashed time-locked contract (HTLC) to carry funds.
In this case, the HTLC was canceled on the network and returned to the sender, while the receiving node still recorded the invoice as settled. The advisory does not describe a failure of Bitcoin's base chain.
Lightning Terminal bundles tapd, software for Taproot Assets, with the lnd Lightning node. In the affected setup, tapd enabled its invoice interceptor and treated any HTLC carrying custom wire records as an asset payment.
Some sender implementations added an experimental endorsement record even to ordinary BTC payments, causing tapd's strict-forwarding rule to instruct lnd to cancel the HTLC set. The trigger did not require the merchant to have any open asset channels.
The second defect sat in lnd. When an interceptor canceled the HTLC set, affected versions canceled the payment on the wire but still marked its invoice as settled in the database.
That meant the error stood in another client of lnd's HtlcModifier interface that canceled an HTLC set could produce the same mismatch. Lightning Labs rates the vulnerability high severity because a false paid status could lead an operator or payment service to release value against a payment that never completed. According to the advisory, the sender's funds were not at risk.
Fixes shipped before disclosure
Lightning Terminal v0.15.0-alpha bundles fixes for both defects. Lightning Labs lists earlier Terminal versions as affected, along with taproot assets through v0.5.0 and lnd 0.18.4-beta through 0.18.5-beta.
The tapd trigger was fixed in v0.5.1 on Feb. 12, 2025. Terminal v0.14.1-alpha included that fix, but its bundled lnd version still had the underlying invoice-state defect.
What to Watch
AI outlook — possibilities, not facts
Lightning Labs will release updated versions of Lightning Terminal, tapd, and lnd to fully address the vulnerability
Very likely · Within weeks
Open Questions
- How many merchants were potentially affected by the flaw?
- What specific versions of Lightning Terminal, tapd, and lnd are vulnerable?
- Are there any known cases of merchants releasing goods due to this error?
