# Unpatched LDK could expose Lightning apps to Bitcoin theft through reconnect flaw

https://mins.news/en/item/95534

- CryptoSlate, 2026-10-11 18:00 UTC
- Tech
- Original: https://cryptoslate.com/unpatched-ldk-apps-can-lose-bitcoin-when-a-lightning-peer-lies-after-reconnecting/

> Lightning Development Kit (LDK) patched a flaw in which a malicious channel peer could reconnect and falsely claim it had not received an update, potentially prompting LDK to sign a conflicting commitment transaction and lose funds from a forwarded payment. Releases 0.2.7 and 0.1.13 fix the reconnect issue on their respective branches; 0.2.7 also addresses an LSPS2 payment-amount flaw. Developers must deploy the patched code and account for pending contracts created under earlier versions.