LND 'Excessive Failback' Vulnerability Is Publicly Disclosed
A publicly disclosed LND flaw showed how a malicious Lightning channel peer could exploit repeated failback behavior under specific conditions and potentially steal nearly all of the victim channel's funds.
On March 4, 2025, security researcher Antoine Riard Morehouse publicly described an 'excessive failback' vulnerability affecting LND, one of the major implementations of the Bitcoin Lightning Network. The flaw involved how certain failed payments and channel-state interactions could be manipulated by a malicious peer.
Under the conditions described in the disclosure, an attacker controlling the other side of a channel could exploit repeated protocol behavior and potentially drain most of the funds allocated to the victim's side. The issue did not compromise Bitcoin's base-layer consensus or cryptography, but it demonstrated how vulnerabilities in second-layer implementations can create real financial risk even when the underlying network remains secure.
The disclosure matters as part of Lightning's maturation from experimental payment technology into production financial infrastructure. Security work increasingly concerned not only protocol ideas but implementation details, adversarial channel behavior, disclosure practices, and the operational risks borne by node operators.