Lightning Labs Patches Critical Bug That Falsely Marked Canceled Invoices as Paid

Lightning Labs disclosed a high-severity vulnerability on September 21, 2026, in older versions of Lightning Terminal that could cause canceled Bitcoin Lightning payments to appear as settled. The flaw stemmed from a mismatch between the software's invoice records and the actual outcome of hashed time-locked contracts (HTLCs). When an HTLC was canceled and returned to the sender, the receiving node incorrectly marked the invoice as paid, potentially leading merchants to release goods or credit without receiving funds. The issue involved the interaction between the tapd asset software and the lnd node, where specific experimental endorsement records triggered incorrect settlement status. Lightning Labs has released a patch to resolve the defect.