Lightning Development Kit releases a security update to fix a fund theft vulnerability

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.

The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.