Lightning Labs disclosed on Sept. 21, 2026, that older Lightning Terminal software could record a Bitcoin Lightning invoice as paid after the payment was canceled and returned to its sender. Merchants relying on the invoice status could release goods or credit without receiving funds, although the company gave no tally of actual losses. The mismatch involved a hashed time-locked contract (HTLC), which carries Lightning payments: the network canceled and returned the HTLC, while the receiving node recorded the invoice as settled. Lightning Terminal combines tapd, software for Taproot Assets, with the lnd Lightning node. In affected configurations, tapd’s invoice interceptor treated HTLCs containing custom wire records as asset payments. Experimental endorsement records added by some senders to ordinary Bitcoin payments triggered a strict-forwarding rule that instructed lnd to cancel the HTLC set, even when merchants had no open asset channels. A second defect in lnd allowed an interceptor-canceled HTLC set to be canceled on the wire while its invoice remained settled in the database. Lightning Labs rated the vulnerability high severity, but said the sender’s funds were not at risk. Lightning Terminal v0.15.0-alpha fixes both defects. Earlier fixes shipped in tapd v0.5.1 on Feb. 12, 2025, and lnd v0.19.0-beta on May 22, 2025, before the September 2026 advisory. Operators unable to update and without asset channels can disable asset mode with --taproot-assets-mode=disable to avoid the observed tapd trigger.