LNbits rushes emergency patch after reported Bitcoin wallet thefts - Cryptonews.net
Bitcoin Lightning wallet platform LNbits has urged users to update immediately to version 1.7.0 after reporting a wave of attacks that resulted in stolen funds.
The project published version 1.7.0 on Tuesday, describing it as a critical release addressing vulnerabilities and strengthening authentication, extension management and payment handling. LNbits warned that updating alone would not protect installations whose credentials had already been compromised.
It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses.
Attack details
LNbits first warned operators on Sunday to disable its Paywall extension while investigating a potential vulnerability. Just over an hour later, the project urged users to shut down their LNbits servers immediately, citing a wave of attacks. The company also took its own hosted installations offline.
One user, Kevin Ravensberg, said attackers exploited his LNbits instance, withdrawing about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut down the server.
Security recommendations
LNbits has not yet detailed the exploit and how many were impacted. The company warned that credentials exposed before upgrading could still give attackers access afterward, urging operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised.
The project recommended moving to a fresh server if a compromise is suspected and said a separate report detailing the exploit would follow.
Related
