Lightning Labs has uncovered a malicious bug that causes cancelled invoices to be marked as paid, risking delivery without payment.

- What's going on?

Lightning Labs disclosed on September 212026 that an older version of the Lightning Terminal software contained a loophole which caused invoices on the Bitcoin Lightning network to be marked as "paid in full", even though payment had been cancelled and money returned to the sender.

The Lightning Terminal is a piece of software that combines two tools, tapd (software for Taproot Assets) and lnd (Lightning configuration).

Why is it important for the store to accept Bitcoin ?

Imagine a store that receives over Lightning Network payments. Usually, the system displays "paid" status on invoices when money is actually received, but with this loophole, the invoice recording system doesn't match the payment results. A payment using an HTLC (hashed time-locked contract) is cancelled on the network and refunded to the sender, but the recipient still records that the bill has been closed.

As a result, stores that believe this situation may be delivering goods or providing credit without receiving actual money Lightning Labs rated the vulnerability as high severity but noted: The sender's account is not at risk. And there's been no disclosure of actual damage to the store.

How do the channels work?

There's two flaws: I don't know what to do with it, but...

1. The other side of the tapd: - Oh, my God! - What? - Shh. tapd opens the invoice interceptor and considers any HTLC with custom wire records as a payment by some asset sender adding an experimental endorsement record to the payment.BTC Typically, tapd's strict-forwarding rule instructs lnd to discontinue the entire set of HTLC without requiring that the asset channels be open at all

1. I've got to get out of here. - Where are you going? - Here we go! When the interceptor disables the HTLC set, the affected version cancels payment on the network but still registers a bill as closed in its database. This bug is present in other clients of lnd's HtlcModifier interface and can create similar inconsistencies.

Importantly, the committee did not identify Bitcoin as a failure of Base chain , but only an application-level software bug.

Did you fix it? What's the user to do now?

Interestingly, all of the patches were released prior to disclosure as well:

• tapd fixes the trigger point in version v0.5.1 (February 122025) by Lightning Terminal v0.14.1-alpha includes this patch, but lnd also has a bill status bug.
• lnd v0.19.0-beta Fixed an accounting bug on May 22.2025
• Lightning Terminal v0.15.0-alpha includes both point patches

Affected versions are all previous Terminal releases, taproot assets to v0.5.0 and lnd 0.18.4-beta to 0.18.5-beta.

For administrators who haven't updated and have no asset channels Lightning Labs suggests avoiding this by using the --taproot-assets-mode=disable parameter to disable a tapd trigger that has been detected.

For shops and payment service providers in Thailand that run Lightning themselves, the idea is to not rely on "paid" status from old software versions alone and check if the current version of lnd and Lightning Terminal includes a patch year.2025