LDK Fixes Vulnerability That Could Have Put Lightning Funds at Risk

The Lightning Development Kit (LDK) has fixed a vulnerability that could have allowed malicious nodes to steal Bitcoin during Lightning channel reconnections, putting node operators and channel funds at risk.

The most serious flaw involved a node falsely claiming it had not received an earlier confirmed channel update. Vulnerable LDK software could then sign a conflicting commitment transaction without properly recording the earlier transaction.

An attacker could potentially exploit the flaw after forwarding a payment, allowing the attacker to regain Bitcoin that should have remained committed to the channel. The issue affected the software used to operate Lightning nodes and manage payment channels.

LDK versions 0.2.7 and 0.1.13 include fixes for the vulnerability. No confirmed losses tied to these specific flaws have been identified in the disclosed information.