Lightning Network tightens BOLT11 invoice rules after reported attack made withdrawals appear unpaid

BOLT11 invoice standard updated on Oct. 19 to require software to reject invoices with missing or repeated payment hash and payment secret fields. The change follows a developer's report that a Telegram peer-to-peer bot attack exploited conflicting invoice parsers, making completed Bitcoin withdrawals appear unpaid and enabling further payouts. Lightning node software lnd has merged duplicate-hash rejection, while payment-secret checks remain under proposal.