How a Lost Response Can Lead to a Duplicate Payout

Between a payment and the information about it

In October 2026, BTCPay Server developers fixed a bug at precisely this boundary: between a payment itself and the information describing it.

BTCPay stored the identifier of a Lightning payout so its status could be checked later. However, if a subsequent lookup found no payment, the software could cancel the payout record and remove its saved information. A missing response effectively became a claim that the payment had not happened.

The fix was merged into the main development branch on October 19. With that change, a payout with a saved identifier remains in progress when the result is uncertain, allowing another check later. This does not mean every user has already installed the change.

Retrying a lookup is not the same as repeating a payment

The preliminary discussion describes a test scenario: the payment system retains a completed operation, but its acknowledgement is interrupted. A subsequent lookup also produces no result. Once communication recovers, the original operation can again be found as completed.

This was a local test with no real payments, not a report of a confirmed theft. But it showed why a missing record cannot be treated as proof of failure.

The cautious solution has a drawback: an uncertain payout may remain unresolved for a long time. An administrator has to investigate instead of receiving a reassuring green tick.

In this case, uncertainty is more honest than a simple answer. Sometimes a system needs to preserve a third state: the money is not necessarily lost, the payment has not necessarily failed — we do not know yet.