LDK Patches Lightning Theft Flaw; Apps Built on It Must Now Ship the Fix

The cryptography held. The conversation lied.

Lightning is bitcoin’s network for instant payments. Two parties keep a private running tab and settle the final total on the blockchain later.

The flaw: your counterparty confirms it received your latest update to the tab, disconnects, then comes back swearing it never did.

Unpatched software could be talked into signing a second, conflicting version of the tab — one its own records never captured. The liar publishes that version and keeps the value of a payment the victim had already passed along.

The direct victims are the middlemen — nodes that forward payments across the network. For everyone else the exposure is indirect. And that is the real story.

LDK is not an app you can update. It is a toolkit — the Lightning engine inside other people’s wallets and payment services.

The fix shipped on 1 October. No theft has been reported. But a library patch protects no one until each developer who built on it rebuilds their app and ships the update to you.

Last month two other Lightning implementations needed emergency patches. Published fixes start a race with anyone reverse-engineering them — and a toolkit adds a lap: the library first, then the app, then your phone.

The keys held. The session lied. Eleven days into the race, nobody can say how many apps are still running the old code.