LNbits ships emergency 1.7.0 patch after attackers drained funds from Lightning wallet servers

Summary

LNbits, the open-source Bitcoin Lightning wallet and accounts platform, released version 1.7.0 on Tuesday as an urgent security update after a wave of attacks on LNbits instances resulted in stolen funds, Bitcoin Magazine and Cointelegraph reported.

On Nov. 8 the project told operators to shut down their LNbits servers immediately and took its own hosted instances offline; Cointelegraph said it had first warned users to disable the Paywall extension a little over an hour earlier.

LNbits said all versions before 1.7.0 are affected and funds on them are at risk of theft, and warned that upgrading alone will not remove access an attacker may already have, according to both outlets.

Neither outlet reported a total amount lost across affected instances, and LNbits has not yet detailed the exploit, saying a separate technical report will follow.

Key facts

• Bitcoin Magazine: BitTipBot operator Kevin Ravensberg said attackers created new accounts on his instance and withdrew 2,285,545 satoshis (about 0.0229 BTC) between roughly 09:22 and 14:00 UTC on Nov. 8; Cointelegraph put it at about 2.3 million satoshis. (Bitcoin Magazine)
• Both outlets: LNbits advised operators to move to a fresh server if compromise is suspected, rotate wallet keys, replace funding-source credentials and treat secrets stored in settings as compromised. (Cointelegraph)
• Cointelegraph: LNbits creator Ben Arc said on X, "It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses." (Cointelegraph)
• Cointelegraph: Ben Arc said in May that about 200,000 people run the software themselves. (Cointelegraph)
• Bitcoin Magazine: the release also adds features including on-chain wallet support, BOLT12 offer payments and TOTP two-factor authentication, and LNbits reminded operators it is a hot wallet that should hold only operational balances. (Bitcoin Magazine)

Related stories

• Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
• Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
• Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor