Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery

A flaw in older Lightning Terminal software could mark a Bitcoin Lightning invoice paid after the payment was cancelled and returned to its sender, Lightning Labs disclosed on Sept. 21, 2026.

A merchant relying on that invoice status could release goods or credit without receiving funds. The company describes that risk but gives no tally of actual merchant losses.

The issue was a mismatch between the software’s invoice record and the payment’s outcome. A Lightning payment uses a hashed time-locked contract (HTLC) to carry funds.

In this case, the HTLC was canceled on the network and returned to the sender, while the receiving node still recorded the invoice as settled. The advisory does not describe a failure of Bitcoin’s base chain.

Lightning Terminal bundles tapd, software for Taproot Assets, with the lnd Lightning node. In the affected setup, tapd enabled its invoice interceptor and treated any HTLC carrying custom wire records as an asset payment.

Some sender implementations added an experimental endorsement record even to ordinary BTC payments, causing tapd’s strict-forwarding rule to instruct lnd to cancel the HTLC set. The trigger did not require the merchant to have any open asset channels.

The second defect sat in lnd. When an interceptor canceled the HTLC set, affected versions canceled the payment on the wire but still marked its invoice as settled in the database.