LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
It has several security fixes to release and asked operators to be careful until they are out; one operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could stop it.
The shutdown notice came about 80 minutes after a first, narrower warning.
That warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug.
As of 09:00 UTC today, the project had not released a fixed version.
On X, it had not canceled the notice, offered another option, or told operators how to check whether their servers were hit before they were shut down.
The project also switched off all the LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday.
Kevin Ravensberg, the operator who reported the loss, said in a loss report on X that his server was exploited before the shutdown notice.
Later yesterday, Ravensberg said in a follow-up post that Arc and a team of security testers had confirmed which exact extension exploit was used on his server.
Ben Arc, an LNbits developer, said in a patch estimate yesterday that patches
They cannot reach their funds until the project fixes the flaws.
What happened
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.
It has several security fixes to release and asked operators to be careful until they are out; one operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could stop it.
What changed
The shutdown notice came about 80 minutes after a first, narrower warning.
That warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug.
As of 09:00 UTC today, the project had not released a fixed version.
Who is affected
On X, it had not canceled the notice, offered another option, or told operators how to check whether their servers were hit before they were shut down.
The project also switched off all the LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday.
Why it matters
Kevin Ravensberg, the operator who reported the loss, said in a loss report on X that his server was exploited before the shutdown notice.
Technical details
Later yesterday, Ravensberg said in a follow-up post that Arc and a team of security testers had confirmed which exact extension exploit was used on his server.
Response
Ben Arc, an LNbits developer, said in a patch estimate yesterday that patches
They cannot reach their funds until the project fixes the flaws.
What remains unknown
It did not say how many servers were attacked or how much was taken.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.