Lightning Development Kit v0.2.6 fixes splice fund diversion and node restart failures
Lightning Development Kit v0.2.6, released September 9, 2026, patches two critical security flaws in LDK toolkit. One allows a malicious peer to divert funds during a splice operation; the other can prevent nodes from restarting by corrupting saved channel state. No losses have been reported.
Who this affects
Quoted from the advisory linked below. The desk does not restate it.
- Affected
- LDK versions prior to v0.2.6
- Fixed in
- v0.2.6
- What to do
- Developers maintaining affected applications should incorporate the patched toolkit into the software they operate.
Lightning Development Kit v0.2.6, released September 9, 2026, patches two separate critical security flaws that could either divert funds or prevent payment-service infrastructure from recovering after shutdown. LDK is a toolkit for building Bitcoin Lightning applications and packages a Lightning implementation as a software development kit for uses including mobile wallets and payment-service infrastructure, per CryptoSlate.
The first flaw affects splice operations. A splice lets a node add funds to or remove funds from an existing payment channel by spending the channel's funding output and replacing it with a new one. A malicious peer could cause excess fee allocation during a splice, with the excess going to that peer's output, putting a small amount of funds at risk when a node initiates a splice, according to the outlet's reporting. The release describes only "a small amount of funds at risk" without specifying a numerical ceiling.
The second vulnerability involves two payment contracts sharing the same payment hash. After one had been successfully forwarded, receiving and immediately rejecting a bogus one could leave ChannelManager state unable to load. ChannelManager is LDK's component for managing channels and payments; restarting an existing node involves reading its saved state back into memory, called deserialization. If saved ChannelManager state is rejected during loading, the application cannot complete its normal restart, per CryptoSlate. Rejecting the bogus payment alone does not resolve the restart failure.
LDK's core implementation is compiled into applications; developers choose the surrounding storage, wallet, networking and blockchain-monitoring components. This architecture means the fix must be integrated into each application individually. The release notice reports no observed losses or exploited applications as of September 9.
With v0.2.6 available, the immediate task for affected application teams is to bring those fixes into the software they operate.
Two separate critical vulnerabilities in LDK allow fund diversion during splice operations and node restart failures via corrupted ChannelManager state, both now patched in v0.2.6.
Developers maintaining mobile wallets and payment services built on LDK should incorporate v0.2.6 into production systems. The two flaws create separate failure modes: fund loss during splices and complete service downtime from restart failures. Neither has been exploited in the wild, but both remain possible until applications patch.
Ranked, source-checked, and verified by the desk's independent review pass.
Sources
More on Lightning
Other reporting from this desk on Lightning.
- AI bug reports trigger emergency warning for Bitcoin Lightning node operators · August 28, 2026 · 2:55 AM ET
- Active exploit drains Lightning nodes running BTCPay; immediate patching required · August 8, 2026 · 2:56 PM ET