LDK FIXED A LIGHTNING BUG THAT LET A PEER WALK OFF WITH A FORWARDED PAYMENT — THE FIX SHIPPED OCTOBER 1 — THE DETAILS WENT PUBLIC OCTOBER 9

If you use a Lightning wallet or node built on LDK, go check the version. LDK cut security releases 0.2.7 and 0.1.13 on October 1, 2026, and the Bitcoin Optech newsletter of October 9 spells out what one of them fixed. A peer could reconnect and claim it had missed a commitment it had already acknowledged. LDK would believe it, sign a fresh valid commitment, and not record it. Later the node could pay out on the next hop and fail to collect the incoming side, even with the preimage in hand. The peer just waits for the payment to expire and takes it back.

Version 0.2.7 carries two more money bugs, per Optech. One let a payer ask a Lightning service provider to forward more than the payer actually sent, so the provider covered the difference. The other could cost a forwarding node a payment if it restarted from older saved state. Core Lightning put out its own security release on October 7, which we covered then.

LDK is a library, not an app, so the fix only reaches you when the wallet you use ships it. The version string is checkable. Whether your wallet’s developers have pulled in 0.2.7 is something you’ll have to look up or ask. Lightning runs on signed promises between two parties, and a bookkeeping bug lets one side cash a promise the other forgot it made. At the time of this writing, bitcoin was $82,895.