Lightning Development Kit (LDK), software used to build Bitcoin Lightning applications, has a privacy fix that blocks a documented probe linking an unannounced channel to the Bitcoin output backing it. Bitcoin Optech highlighted the change on October 30.
An unannounced channel stays out of the public network map. But the probe showed that this alone did not prevent LDK's onion-message forwarding lookup from confirming the channel's funding link.
How the probe worked
A real short-channel ID, or SCID, works like blockchain coordinates. The Lightning specification defines it using the block height, the transaction's position within that block and the output's position within that transaction. Together, those identify the Bitcoin output funding a channel.
An attacker can derive a candidate SCID from an output's location without knowing whether it belongs to a channel between the suspected nodes. The documented probe supplies that missing confirmation. It requires the attacker to connect to both endpoints and construct an onion-message path through them that returns to the attacker.
Before the fix, LDK's channel lookup could resolve a real SCID even for an unannounced channel once its funding confirmed. If the message returned successfully, the attacker could confirm that the guessed output and the channel between those nodes matched. The demonstrated leak therefore joined two pieces of information: a Bitcoin funding output and the Lightning nodes using it.
What the fix changes
LDK now refuses to resolve an unannounced channel's real SCID for onion-message forwarding. Valid aliases remain usable as alternative identifiers, so a sender can address the channel without using its real blockchain coordinates. The change closes this lookup route while preserving forwarding that uses an allowed alias.
Under BOLT 4's onion-routing rules, an onion-message SCID must correspond to an announced identifier or a local alias. The change is described in the pull request, and the rejection excepts a value equal to the outbound alias.
Deployment remains unconfirmed
The merge does not establish release inclusion or deployed wallet coverage. The fix's inclusion in installed wallet versions remains unverified. Users need confirmation from their wallet provider before assuming installed software has this protection.
