Lightning Development Kit Patches Vulnerabilities Risking Bitcoin Theft Across Payment Apps

The Lightning Development Kit (LDK) has issued critical security patches across versions 0.2.7 and 0.1.13 to prevent potential Bitcoin theft in Lightning payment applications. The primary vulnerability allowed malicious peers to exploit reconnect sequences, falsely deny received channel updates, and induce LDK into signing conflicting commitment transactions that bypassed channel monitors. Additionally, version 0.2.7 addressed an amount-validation flaw in the LSPS2 protocol that could cause liquidity providers to forward excess Bitcoin. It remains unconfirmed whether any applications suffered financial losses prior to the rollout.