Woofun AI reports that a severe security flaw in LND exposes Lightning nodes to full-channel wipeout risks within the Bitcoin network. This vulnerability compromises channel security by allowing state loss during specific chain reorganization events.

The attack vector exploits a timing gap where LND forgets a cooperatively closed channel after the first on-chain confirmation. A malicious peer initiates the close, waits for one-block reorganization potential, and then publishes a revoked commitment. Because the node lacks the necessary state, it fails to broadcast penalty transactions. Consequently, the attacker captures the channel's full balance, representing the maximum theoretical loss under this scenario.

Woofun AI data shows that upstream repository history confirms the official fix resides in version 0.21.0, contradicting earlier claims regarding 0.20.0. This discrepancy means operators cannot rely on the 0.20.0 cutoff for safety. Other Lightning implementations are not confirmed to share this flaw. Standard releases below 0.21.0 must be treated as vulnerable unless manually updated.

The technical resolution forces LND to retain close state while awaiting multiple confirmations. It also ensures the software reacts to reorganization notifications rather than finalizing after one block. This marks a critical update for maintaining node integrity against sophisticated peer attacks.