LDK releases fixes for Lightning fund-theft vulnerabilities
LDK 0.2.7 corrected theft and denial-of-service paths involving channel counterparties and liquidity-service clients.
LDK's version 0.2.7 release, named October 1, 2026, in its notes and tagged at October 2, 00:00 on GitHub, fixed two funds-theft vulnerabilities and two denial-of-service vulnerabilities. The security fixes addressed malicious channel counterparties and, for one theft path, an LSPS2 liquidity-service client.
Lightning nodes must preserve consistent state across updates, reconnections and on-chain enforcement. The release corrected behavior in which a counterparty could acknowledge an update, reconnect and deny receiving it, exposing the victim to signing an unsafe state.
These were implementation-level security defects with potential consequences for funds, not merely failures to route a payment. At the same time, a published fix did not establish that every affected application had already upgraded or that every vulnerability had been exploited.
For software built with LDK, the release changed the defensive options available to developers. It documented the importance of reconciling local channel state with what a hostile peer claims after reconnection.