Lightning Labs discloses bug that marked canceled Bitcoin invoices as paid

Older Lightning Terminal builds could show a canceled payment as settled

Lightning Labs disclosed on Sept. 21, 2026 that older versions of its Lightning Terminal software could record a Bitcoin Lightning invoice as paid even after the payment was canceled and the money was returned to the sender.

According to the company's advisory, a merchant who relied on that invoice status could release goods or credit without receiving any funds. Lightning Labs describes that risk but does not give a tally of actual merchant losses.

The advisory says the sender's funds were not at risk, and it does not describe a failure of Bitcoin's base chain.

Key points

• Older Lightning Terminal versions could mark canceled Bitcoin payments as settled after the funds went back to the sender.
• Merchants trusting the false status risked handing over goods or credit without being paid.
• Lightning Labs rates the vulnerability high severity because a false paid status could lead an operator or payment service to release value against a payment that never completed.
• Both defects were fixed in 2025, but the company lists earlier versions as affected, and outdated installations stay exposed.

How the invoice and the payment result came apart

The problem was a mismatch between what the software recorded for an invoice and what actually happened to the payment. A Lightning payment uses a hashed time-locked contract, or HTLC, to carry funds. In this case, the HTLC was canceled on the network and returned to the sender, while the receiving node still logged the invoice as settled.

Lightning Terminal bundles tapd, the software for Taproot Assets, with the lnd Lightning node. In the affected setup, tapd enabled its invoice interceptor and treated any HTLC carrying custom wire records as an asset payment. Some sender implementations added an experimental endorsement record even to ordinary BTC payments, which caused tapd's strict-forwarding rule to instruct lnd to cancel the HTLC set. The trigger did not require the merchant to have any open asset channels.

A second defect sat in lnd. When an interceptor canceled the HTLC set, affected versions canceled the payment on the wire but still marked its invoice as settled in the database. The advisory notes that the same mismatch could come from another client of lnd's HtlcModifier interface that canceled an HTLC set.

Fixes shipped in 2025, disclosure came in 2026

Lightning Terminal v0.15.0-alpha bundles fixes for both defects. Lightning Labs lists earlier Terminal versions as affected, along with taproot assets through v0.5.0 and lnd 0.18.4-beta through 0.18.5-beta.

The tapd trigger was fixed in v0.5.1 on Feb. 12, 2025. Terminal v0.14.1-alpha included that fix, but its bundled lnd version still had the underlying invoice-state defect.

lnd v0.19.0-beta fixed the accounting error on May 22, 2025. The September 2026 advisory therefore disclosed a vulnerability whose relevant fixes had already shipped in 2025.

For Terminal operators who cannot update and have no asset channels, Lightning Labs points to --taproot-assets-mode=disable as a way to avoid the observed tapd trigger.

What is confirmed

Lightning Labs disclosed the flaw on Sept. 21, 2026, and its advisory states that canceled payments could be recorded as settled. The company confirms the affected software versions, the two fix releases and their 2025 dates, the high severity rating, and the workaround option. It also states that sender funds were not at risk and that Bitcoin's base chain did not fail.

What is still unclear

The advisory gives no total of merchant losses, so it is not known whether anyone actually released goods or credit because of the false paid status. The source also does not say how many installations remain on affected versions.

Why this matters

For businesses that accept Bitcoin over Lightning, an invoice marked paid is normally the signal to hand over a product or extend credit. A false paid status can therefore cost a merchant the full value of an order. Because the fixes were released in 2025 but disclosed publicly in 2026, the practical risk now depends on whether operators have updated their software.

Sources

• CryptoSlate