Bitcoin Lightning Wallet LNbits Deploys Critical Security Update Following Theft Reports
Following reports of cryptocurrency theft, LNbits has issued an urgent security update, advising users to immediately upgrade their Lightning wallet installations and change their security credentials.
The Bitcoin Lightning wallet platform LNbits has issued an urgent call for users to immediately upgrade to the newest software version following reports of a series of attacks on LNbits instances that led to the theft of user funds.
On Tuesday, the project released version 1.7.0, characterizing it as an essential update that resolves security flaws and enhances authentication mechanisms, extension oversight and payment processing capabilities. The team cautioned that simply upgrading to the new version would not safeguard systems where login credentials had already been obtained by malicious actors.
It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses
LNbits creator Ben Arc on X
The platform offers software solutions for operating Bitcoin Lightning wallets and payment-related applications, encompassing merchant payment systems, tipping platforms and paywall implementations. In May, developer Ben Arc indicated that approximately 200,000 individuals operate the software on their own infrastructure.
On Sunday, LNbits initially advised operators to deactivate its Paywall extension as the team investigated a possible security weakness. Slightly more than one hour after this initial warning, the project issued a more urgent directive for users to immediately shut down their LNbits servers, referencing an ongoing wave of security breaches. The organization also brought its own managed installations offline.
The organization has not yet disclosed specific details about the security exploit or provided information regarding the number of users affected by the incident. In a statement released alongside the emergency security patch, LNbits indicated that the vulnerability is present in all versions prior to 1.7.0 and creates a risk of fund theft.
The team further cautioned that login credentials that were exposed prior to performing the upgrade could continue to provide attackers with unauthorized access even after the update, advising operators to regenerate wallet keys, update funding-source credentials and consider any sensitive information stored in LNbits settings as potentially compromised and suggested migrating to a new server installation if a security breach is suspected.
Cointelegraph reached out to Ben Arc and LNbits for comment.
A user named Kevin Ravensberg reported that malicious actors exploited his LNbits instance, successfully withdrawing approximately 2.3 million satoshis, equivalent to 0.023 Bitcoin, via newly established accounts before he was able to take the server offline.
The organization indicated that a detailed report explaining the nature of the exploit would be published at a later date.