BOLT11 invoice rules tightened after reported attack
Current overview (not historical)
Lightning Network tightened BOLT11 invoice rules to prevent misjudgment of unpaid withdrawals. Roasbeef reported that Telegram peer-to-peer bots were exploited, causing some libraries to parse conflicting payment hashes from invoice headers and trailers, which led to completed Bitcoin withdrawals being falsely marked as unpaid and inducing further payments. In response, the BOLT11 standard was updated on October 19 to require software to reject invoices with missing or duplicate payment hash (p) and payment secret (s) fields.
Written with AI from the reporting · updated 10/27/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 19, 00:00recorded Oct 28, 03:09single sourcerevised
BOLT11 invoice rules tightened after reported attack
Read original source ↗ CryptoSlateReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Lightning Network
- Action：
- require software to reject ambiguous payment-hash and payment-secret fields
- Object：
- BOLT11 invoice standard
- Occurred (fact side)：
- Oct 19, 00:00
- Published (valid side)：
- Oct 28, 03:00
- First seen (known side)：
- Oct 28, 03:09
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CryptoSlateRelated fact: single sourceSource report revisedLightning Network tightens BOLT11 invoice rules after reported attack made withdrawals appear unpaid
Report first recorded Oct 28, 03:09
BOLT11 invoice standard updated on Oct. 19 to require software to reject invoices with missing or repeated payment hash and payment secret fields. The change follows a developer's report that a Telegram peer-to-peer bot attack exploited conflicting invoice parsers, making completed Bitcoin withdrawals appear unpaid and enabling further payouts. Lightning node software lnd has merged duplicate-hash rejection, while payment-secret checks remain under proposal.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 7Oct 28, 14:00
- 24h change
- -50%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.