Cryptoupdated 21m ago2 min read
LNbits Issues Emergency Patch After Reported Bitcoin Lightning Wallet Theft
“Later yesterday, Ravensberg said in a follow-up post that Arc and a team of security testers had confirmed ‘which exact extension exploit was used’”
“The company has not yet detailed the exploit and how many were impacted by it.”
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
LNbits released emergency version 1.7.0 to fix vulnerabilities after a wave of attacks. Operators urged to shut down servers and upgrade immediately, replacing potentially exposed credentials.
Save coverage image
LNbits urges emergency update
LNbits said a wave of attacks targeting its Bitcoin Lightning wallet software resulted in stolen funds and urged users to install an emergency security update. LNbits released software version 1.7.0 to fix the vulnerability and asked all operators to update immediately, while it warned that the vulnerability affects all versions before 1.7.0. LNbits also told operators to replace wallet access keys and credentials tied to funding sources, and it said any secrets stored in settings should be treated as compromised.
Ben Arc said on X, "It’s been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," as the project prepared the patch. LNbits said it plans to publish a report on how the hack unfolded and the findings of its security investigation.
Paywall warning to server shutdown
LNbits first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability. LNbits then urged users to shut down their LNbits servers immediately, and it took its own hosted installations offline as attacks continued. LNbits warned that updating alone would not protect installations whose credentials had already been compromised, and it said credentials exposed before the update could still let attackers gain access afterward.
Kevin Ravensberg said attackers exploited his LNbits instance, withdrawing about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut the server down. LNbits also advised operators to reset wallet keys, replace funding-source credentials, and consider migrating to a new server environment if a server may already have been breached.
Scale, guidance, and next report
LNbits said the vulnerability affects all versions before 1.7.0 and put funds at risk of theft, while it said it had not disclosed the specific vulnerability used in the attacks or the total scale of losses so far. LNbits creator Ben Arc said on X that the team was working intensely to roll out version 1.7, after users and the team "suffered losses" over the past few days. Ben Arc said in May that about 200,000 people run the software themselves, and the project’s guidance emphasized that operators should treat secrets stored in LNbits settings as compromised.
The Hacker News reported that patches "should be merged and available within 24-48hrs" and described a shutdown notice that did not name the exact extension exploit used in the attacks. LNbits said it would publish a separate report detailing the exploit, and it urged operators to install the updated software on a fresh server when compromise is suspected.