quote: BITCOIN LIGHTNING DEVELOPERS PATCH SECURITY FLAWS THAT COULD ALLOW FUNDS TO BE STOLEN Lightning Development Kit (LDK), an open-source library used to build Bitcoin Lightning wallets and payment applications, has released security updates addressing vulnerabilities that could allow malicious peers to steal funds. The most serious flaw involves Lightning channel reconnections. According to Bitcoin Optech, a malicious peer could falsely claim that it never received a previously acknowledged channel update. Vulnerable LDK software could then sign a conflicting commitment transaction without properly recording it, potentially allowing the attacker to reclaim Bitcoin after a forwarded payment had already been settled. LDK versions 0.2.7 and 0.1.13 address the vulnerability. No confirmed losses from these specific vulnerabilities were identified in the reviewed disclosures. | LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft. If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3. 1/4