LNbits Issues Emergency Patch After Reported Bitcoin Lightning Wallet Theft: how 11 outlets framed it - NewsCord

The project stated that the vulnerability affects all versions before 1.7.0 and that any secrets stored in settings should be treated as compromised.

Operators were advised to replace wallet access keys and funding-source credentials, and to consider migrating to a new server environment if a breach is suspected.

Ben Arc, the creator of LNbits, said on X that the team was working intensely to roll out version 1.7 after users and the project itself suffered losses.

Shutdown and Paywall Warning

LNbits first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability.

The platform then urged users to shut down their LNbits servers immediately and took its own hosted installations offline as attacks continued.

The Hacker News reported that patches should be merged and available within 24-48 hours, and described a shutdown notice that did not name the exact extension exploit used in the attacks.

LNbits also warned that updating alone would not protect installations whose credentials had already been compromised.

Scale of Reported Losses

One affected user, Kevin Ravensberg, said attackers exploited his LNbits instance, withdrawing about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut the server down.

The project said it had not disclosed the specific vulnerability used in the attacks or the total scale of losses so far.

Ben Arc said in May that about 200,000 people run the software themselves, and the project’s guidance emphasized that operators should treat secrets stored in LNbits settings as compromised.

Next Steps and Investigation

LNbits said it plans to publish a report on how the hack unfolded and the findings of its security investigation.

The platform urged operators to install the updated software on a fresh server when compromise is suspected.

Cointelegraph reported that LNbits has not detailed the exploit, while The Hacker News added that it claimed extension identification.