SECURITY ALERT

The patch is out.

The keys an attacker already holds still work.

LNbits, free software that shop owners, tipping services and hobbyists run to operate bitcoin Lightning wallets, says all operators must upgrade to version 1.7.0 before running LNbits. Versions before 1.7.0 are affected, it says, and “funds running on prior versions of LNbits are at risk of being stolen”.

The project has not published a loss figure.

Its creator, Ben Arc, wrote on X that the team worked to ship the release “after our users and we suffered losses”. One operator described losing about 2.3 million satoshis, or 0.023 BTC, through newly created accounts, Cointelegraph reported. We have not verified that account.

The timeline

At 12:33 UTC on Sunday 8 Nov, LNbits told operators to disable its Paywall extension “while we investigate a potential bug”.

At 13:56 UTC it went further: every LNbits user should stop their servers “IMMEDIATELY”, following “a wave of attacks”.

At 17:18 UTC it switched off all instances on its own hosted service as a precaution.

On Tuesday 10 Nov, version 1.7.0 appeared on GitHub at 17:09 UTC, labelled a critical security release. LNbits announced it on X at 20:37 UTC.

LNbits has not said how the attacks worked. It promises a separate report on the exploit.

So what does a patched server still have to fear?

Why upgrading is not enough

LNbits is a hot wallet. The credentials that spend its funds sit on a machine connected to the internet.

If an attacker copied those credentials before you upgraded, the new version does not cancel them. LNbits says so plainly: credentials exposed before the upgrade “may still give an attacker access afterwards”.

Its guidance treats every secret stored in LNbits settings as compromised.

This is the second self-hosted bitcoin payment tool in ten days to tell operators that old versions were the way in, after attackers swept hot wallets on older BTCPay Server installs at the start of the month.

How much is still sitting online that does not need to be?

Protect yourself

  • Do not restart an LNbits server on any version before 1.7.0. If you suspect a compromise, LNbits recommends installing 1.7.0 on a fresh server and keeping the old server’s logs.
  • As super admin, reset all wallet keys (Settings → Users → Reset Wallet Keys), then revoke and replace the API keys or macaroons at your funding source.
  • Delete and recreate connections in the NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA extensions with new credentials.
  • Keep only day-to-day amounts in the hot wallet and move the rest to an onchain wallet whose keys stay offline, as LNbits advises.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.