{"id":14990,"date":"2026-10-27T19:23:47","date_gmt":"2026-10-27T19:23:47","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14990"},"modified":"2026-10-27T19:23:47","modified_gmt":"2026-10-27T19:23:47","slug":"bolt11-invoice-rules-tightened-after-reported-bitcoin-payout-attack","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14990","title":{"rendered":"BOLT11 invoice rules tightened after reported Bitcoin payout attack"},"content":{"rendered":"<p><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>Lightning developers tightened BOLT11, the Lightning Network\u2019s invoice standard, on Oct. 19 to require software to reject ambiguous payment-hash and payment-secret fields. The change follows a developer\u2019s account of an attack that made completed Bitcoin withdrawals appear unpaid.<\/p>\n<p>The merged change targets software components reading the same signed payment request differently. A payment hash identifies the payment a component is tracking. Bitcoin Optech highlighted the rule change on Oct. 23.<\/p>\n<p>In a Sept. 10 statement on the proposal, developer Roasbeef reported a recent hack of a Telegram peer-to-peer bot that exploited libraries choosing different hashes: some took the first payment-hash field in an invoice, while others took the last. He gave no incident date or loss figure.<\/p>\n<p>In practical terms, a service could track a withdrawal under one hash while its node executes a payment using another. The service could then mistake the completed withdrawal for an unpaid one, creating an opening for further payouts. The failure sits in the connection between payment execution and the service\u2019s accounting.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Lightning Labs discloses critical bug marking canceled invoices paid, risking free product delivery<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<h2>What readers must reject<\/h2>\n<p>The current BOLT11 specification requires exactly one payment-hash field, labeled <code>p<\/code>, and exactly one payment-secret field, labeled <code>s<\/code>. A missing field or a second occurrence requires payment failure. The rule covers both kinds of ambiguity, while the described withdrawal attack concerned conflicting payment hashes.<\/p>\n<p><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-576997\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908.png\" alt=\"Illustrative hash mismatch: a Lightning node pays using Hash A while a service tracks Hash B and may see an unpaid withdrawal. BOLT11 requires exactly one payment-hash field and one payment-secret field.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908-768x960.png 768w\" sizes=\"auto, (max-width: 720px) 100vw, 720px\"\/><img loading=\"lazy\" loading=\"lazy\" decoding=\"async\" class=\"lazyload aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-576997\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908.png\" alt=\"Illustrative hash mismatch: a Lightning node pays using Hash A while a service tracks Hash B and may see an unpaid withdrawal. BOLT11 requires exactly one payment-hash field and one payment-secret field.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-d0e8eeaf-fd8f-4522-9767-0fa16b89b908-768x960.png 768w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><\/p>\n<p>Readers must count field occurrences. The proposal\u2019s invalid test cases include an invoice repeating the same hash, as well as one containing distinct hashes. Collapsing identical values into a single value would therefore miss an invoice the rule requires readers to reject.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter cs-newsletter-brand\" data-newsletter-edition=\"catalyst\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\">\n<div class=\"cs-inline-newsletter__editorial\">\n<p class=\"cs-inline-newsletter__eyebrow\">The Catalyst<\/p>\n<p class=\"cs-newsletter-frequency\">Daily Newsletter<\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">Know what\u2019s moving crypto.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start with the stories that matter. Get the context behind the headlines and a clear view of what to watch next.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__art\" aria-hidden=\"true\"> <img loading=\"lazy\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><img loading=\"lazy\" class=\"lazyload\" src=\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/catalyst-newsletter-scrapbook-v3.webp\" alt=\"\" width=\"640\" height=\"640\" loading=\"lazy\" decoding=\"async\"\/><\/div>\n<\/div>\n<\/div>\n<\/aside>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Critical Bitcoin Lightning bugs exposed nodes to fund theft and restart failure<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The implementation timeline also matters. The Lightning node software lnd merged duplicate-hash rejection on Sept. 23, before the specification change. Its available v0.20.5-beta and v0.21.4-beta releases include that payment-hash fix.<\/p>\n<p>The broader payment-secret checks are addressed by a separate lnd proposal that remained open as of Oct. 27. It would tighten payment-secret and other decoder checks, including rejecting a second <code>s<\/code> field. The author also explains that some invoices accepted by the decoder already face checks later in payment processing, so decoding success alone does not establish that a payment will go through.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Bitcoin Lightning developers sound alarm over security flaws as second patch lands in five days<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>For payment operators, the documented failure points to two checks: reject ambiguous invoices and ensure withdrawal accounting follows the same payment hash as the node.<\/p>\n<\/div>\n<p>Featured,Lightning,Payments,Technology,Bitcoin,BTC,paymentsBitcoin,BTC,payments#BOLT11 #invoice #rules #tightened #reported #Bitcoin #payout #attack1793129027<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Lightning developers tightened BOLT11, the Lightning Network\u2019s invoice standard, on Oct. 19 to require software to reject ambiguous payment-hash and payment-secret fields. The change follows a developer\u2019s account of an attack that made completed Bitcoin withdrawals appear unpaid. The merged change targets software components reading the same signed payment request differently. A payment hash identifies<\/p>\n","protected":false},"author":1,"featured_media":14991,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[1280,91,7617,285,7618,167,2851,4942,390,7619],"class_list":["post-14990","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-attack","tag-bitcoin","tag-bolt11","tag-btc","tag-invoice","tag-payments","tag-payout","tag-reported","tag-rules","tag-tightened"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>BOLT11 invoice rules tightened after reported Bitcoin payout attack - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Lightning\u2019s BOLT11 change rejects missing or repeated invoice fields after a reported Bitcoin payout exploit linked to conflicting payment hashes.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=14990\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BOLT11 invoice rules tightened after reported Bitcoin payout attack\" \/>\n<meta property=\"og:description\" content=\"Lightning\u2019s BOLT11 change rejects missing or repeated invoice fields after a reported Bitcoin payout exploit linked to conflicting payment hashes.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=14990\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-27T19:23:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14990\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=14990\",\"name\":\"BOLT11 invoice rules tightened after reported Bitcoin payout attack - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14990#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14990#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp\",\"datePublished\":\"2026-10-27T19:23:47+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Lightning\u2019s BOLT11 change rejects missing or repeated invoice fields after a reported Bitcoin payout exploit linked to conflicting payment hashes.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14990#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=14990\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14990#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14990#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"BOLT11 invoice rules tightened after reported Bitcoin payout attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"BOLT11 invoice rules tightened after reported Bitcoin payout attack - Crypto News: Latest Cryptocurrency News and Analysis","description":"Lightning\u2019s BOLT11 change rejects missing or repeated invoice fields after a reported Bitcoin payout exploit linked to conflicting payment hashes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=14990","og_locale":"en_US","og_type":"article","og_title":"BOLT11 invoice rules tightened after reported Bitcoin payout attack","og_description":"Lightning\u2019s BOLT11 change rejects missing or repeated invoice fields after a reported Bitcoin payout exploit linked to conflicting payment hashes.","og_url":"https:\/\/cryptonews.uk.com\/?p=14990","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-10-27T19:23:47+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=14990","url":"https:\/\/cryptonews.uk.com\/?p=14990","name":"BOLT11 invoice rules tightened after reported Bitcoin payout attack - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=14990#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=14990#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp","datePublished":"2026-10-27T19:23:47+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Lightning\u2019s BOLT11 change rejects missing or repeated invoice fields after a reported Bitcoin payout exploit linked to conflicting payment hashes.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=14990#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=14990"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=14990#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/lightning-withdrawal-hash-mismatch.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=14990#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"BOLT11 invoice rules tightened after reported Bitcoin payout attack"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14990"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14990\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/14991"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}