Daily Summary2026-10-12

The Lightning Development Kit (LDK), a toolkit for building Lightning wallets and payment apps, shipped security releases on 1 October (v0.2.7 and v0.1.13) fixing a flaw in which a channel peer could acknowledge an update, reconnect and deny receiving it — tricking unpatched software into signing a conflicting channel state and risking theft of a forwarded payment. Bitcoin Optech documented the fix on 9 October; no theft has been reported.

The Block reports a trader netted about $1.28 million on Papertrade, a new exchange offering 1,000x leverage. Papertrade copies its prices from Hyperliquid’s order book, and the trader simply moved that order book — buying and selling large amounts of ETH on Hyperliquid itself. Papertrade said its launch trading limits were too loose and is tightening them.

Ledger confirmed an unauthorised hardware implant in a device sold by CryptoBilis, an authorised reseller in Southeast Asia. Loss estimates vary by tracker: Bitquery puts them at about $93 million across 311 wallets; earlier estimates ran $72–86 million. Ledger says all confirmed cases trace to CryptoBilis, has not confirmed how the implant worked, and advises affected users to move funds to a new device with a new recovery phrase.

Liquid, a Blockstream-managed network backed one-for-one by deposited bitcoin, still has redemptions frozen five weeks after a September exploit drained its reserve. White hats returned most of the roughly 4,000 BTC taken; about 600 BTC remain missing, leaving backing near 86%. Coverage reports Blockstream refused the attacker’s demand for a 10% bounty; Liquid says redemptions resume only when backing is full and security reviews are complete.