LND Discloses Two Fund-Theft Vulnerabilities and a Denial-of-Service Flaw

On December 4, 2025, LND developers publicly disclosed three serious Lightning Network vulnerabilities that had already been fixed in LND 0.19.0. Two were described as theft-of-funds vulnerabilities, while the third allowed an attacker to exhaust a node's memory and cause it to crash or hang. The disclosure urged users running older releases to upgrade immediately.

The denial-of-service problem arose from large internal queues combined with an unrestricted incoming-connection policy, allowing an attacker to consume available memory. The fund-loss bugs were more serious because Lightning nodes actively manage Bitcoin through payment channels whose security depends on correct protocol handling and timely responses to adversarial channel states. A remotely exploitable implementation flaw can therefore threaten actual bitcoin even when Bitcoin's base-layer consensus rules remain unaffected.

The December date represents public disclosure, not the moment the vulnerabilities were first discovered or fixed. That procedural distinction is important in security history. LND 0.19.0 had already contained the fixes, and disclosure came after users had an upgrade path. Recording the public disclosure captures the moment the broader operator community learned the nature of the risk and could understand why upgrading was urgent.

The incident also demonstrated a recurring feature of Lightning's security model: Bitcoin can remain secure at the base layer while software running payment-channel logic still introduces implementation-specific risks. LND was one of the most widely used Lightning implementations, so flaws capable of stealing funds were more than ordinary release-note bugs. They were a reminder that scaling Bitcoin through additional protocol layers also expands the surface where software correctness directly protects user funds.