By Isaac • September 13, 2026 12:59 pm •
Lightning Dev Kit has shipped a security update that closes two very different failure paths: one that could let a malicious channel peer redirect a small amount of a user’s funds, and another that could leave a node unable to restart.
Neither issue produced a reported loss or known exploitation. That does not make the update optional.
For wallet developers and payment companies using LDK, version 0.2.6 is the kind of release that should move quickly from a changelog into production.
The splice bug put real funds in the path.
The official Lightning Dev Kit 0.2.6 release notes say a malicious peer could exploit fee allocation during a splice. A splice changes the amount of bitcoin
Continue reading
Join the conversation!
Please share your thoughts about this article below. We value your opinions, and would love to see you add to the discussion!