Bitcoin Lightning wallet platform LNbits has urged users to upgrade to version 1.7.0 following a series of attacks that resulted in stolen funds from LNbits instances.
The new release, published on Tuesday, is described as a critical update that addresses vulnerabilities and improves authentication, extension management, and payment handling. LNbits warned that simply updating may not protect installations whose credentials have already been compromised.
Background
LNbits provides software for operating Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services, and paywalls. The project's creator, Ben Arc, previously estimated that about 200,000 individuals run the software themselves.
Timeline of the Incident
On Sunday, LNbits advised operators to disable its Paywall extension while investigating a potential vulnerability. Within an hour, the project instructed users to shut down their LNbits servers due to a wave of attacks and took its own hosted installations offline.
Details of the Vulnerability
The company has not disclosed the specific exploit or the number of affected installations. The vulnerability is said to affect all versions prior to 1.7.0 and could expose funds to theft.
Recommended Actions
- Upgrade to version 1.7.0 immediately.
- Reset wallet keys and replace funding-source credentials.
- Treat any secrets stored in LNbits settings as compromised.
- Consider moving to a fresh server if a compromise is suspected.
One user reported that attackers withdrew approximately 2.3 million satoshis (0.023 BTC) from his LNbits instance through newly created accounts before the server could be shut down.
LNbits indicated that a separate report detailing the exploit will be released later.
