LNbits, a free, open-source Bitcoin Lightning wallet system, has told operators to shut down their servers amid a wave of attacks. The project said it still has several security fixes to release and asked people to be careful until those updates are available.
Emergency shutdowns and a theft report
The first notice came yesterday and was narrower in scope. It asked operators to disable Paywall, an add-on that lets people pay to view content, while the project investigated a possible bug. About 80 minutes after that warning, the project widened the advice to a full shutdown of LNbits servers.
One operator reported losing 2,285,545 satoshis, or about 0.023 bitcoin, from his server before he could stop the attack. He said new accounts used an exploit to withdraw the funds. As of 09:00 UTC today, the project had not released a fixed version, and on X it had not canceled the notice, offered another option, or explained how operators could check whether their servers had been hit before shutdown.
What the timeline shows
Ben Arc, an LNbits developer, said in a patch estimate yesterday that fixes “should be merged and available within 24-48hrs.” Counted from that post, that places availability between about 14:00 UTC today and 14:00 UTC tomorrow. The project also switched off all LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday. A hosted-service notice said all services would return within 24 hours, or by about 17:20 UTC today.
The reported attack on Kevin Ravensberg’s server ran from 09:22 to 14:00 UTC yesterday. Ravensberg, the operator who reported the loss, said the compromise began more than three hours before the project’s first warning at 12:33 UTC. He has also promised to repay users of BitTipBot, a Telegram bot, while they cannot reach their funds until the project fixes the flaws.
Unconfirmed details about the exploit
Later yesterday, Ravensberg said in a follow-up post that Arc and a team of security testers had confirmed “which exact extension exploit was used” on his server. Neither he nor the project had named that extension in posts on X as of 09:00 UTC today. The project also had not said whether it was Paywall, the add-on named in its first warning.
The shutdown notice applies to LNbits servers and does not mention Lightning nodes or other wallet software. It also did not say how many servers were attacked or how much was taken.
Licensed under CC BY-ND 4.0 International