diff --git a/watchtower/lookout/lookout.go b/watchtower/lookout/lookout.go
index 280221b6a..28f52cccd 100644
--- a/watchtower/lookout/lookout.go
+++ b/watchtower/lookout/lookout.go
@@ -203,7 +203,7 @@ func (l *Lookout) processEpoch(epoch *chainntnfs.BlockEpoch,
 		// The decryption key for the state update should be the full
 		// txid of the breaching commitment transaction.
 		// The decryption key for the state update should be computed as
-		//   key = SHA256(txid).
+		//   key = SHA256(txid || txid).
 		breachTxID := commitTx.TxHash()
 		breachKey := blob.NewBreachKeyFromHash(&breachTxID)
 
diff --git a/watchtower/wtclient/backup_task.go b/watchtower/wtclient/backup_task.go
index 1e90d7b37..5119a8530 100644
--- a/watchtower/wtclient/backup_task.go
+++ b/watchtower/wtclient/backup_task.go
@@ -339,7 +339,8 @@ func (t *backupTask) craftSessionPayload(
 
 	breachTxID := t.breachInfo.BreachTxHash
 
-	// Compute the breach key as SHA256(txid).
+	// Compute the breach hint as SHA256(txid)[:16] and breach key as
+	// SHA256(txid || txid).
 	hint, key := blob.NewBreachHintAndKeyFromHash(&breachTxID)
 
 	// Then, we'll encrypt the computed justice kit using the full breach
diff --git a/watchtower/wtclient/backup_task_internal_test.go b/watchtower/wtclient/backup_task_internal_test.go
index 7894631b8..8eb0ba9fb 100644
--- a/watchtower/wtclient/backup_task_internal_test.go
+++ b/watchtower/wtclient/backup_task_internal_test.go
@@ -652,7 +652,7 @@ func testBackupTask(t *testing.T, test backupTaskTest) {
 	hint, encBlob, err := task.craftSessionPayload(test.signer)
 	require.NoError(t, err, "unable to craft session payload")
 
-	// Verify that the breach hint matches the breach txid's prefix.
+	// Verify that the breach hint matches the prefix of SHA256(txid).
 	breachTxID := test.breachInfo.BreachTxHash
 	expHint := blob.NewBreachHintFromHash(&breachTxID)
 	require.Equal(t, expHint, hint)