LDK Patches Fix Lightning Reconnect Flaw That Risked Bitcoin Theft

Lightning Development Kit (LDK) has patched a vulnerability that could let a malicious channel peer create a conflicting channel state and potentially steal Bitcoin (BTC) from affected Lightning applications. LDK released versions 0.2.7 and 0.1.13 on Oct. 1 to address the issue, which affects both the 0.2 and 0.1 branches. The attack involved a peer acknowledging a channel update, disconnecting and then falsely claiming after reconnecting that it had never received the update. That behavior could cause an application to sign a conflicting commitment transaction at the same index.

Source: TokenPost