LNbits issues emergency patch after reported Bitcoin wallet thefts

Bitcoin Lightning wallet platform LNbits has released an emergency security update after reported attacks resulted in stolen funds. The project urged operators to install version 1.7.0 before running their systems and warned that credentials exposed before the upgrade could still allow attackers access afterward.

In its security notice, LNbits said the vulnerability was discovered on November 8 and affected every version before 1.7.0. It described funds on those earlier releases as at risk of theft, making the update an urgent requirement rather than a routine maintenance release.

The warning followed an escalating response to the incident. According to Cointelegraph, LNbits initially asked operators to disable its Paywall extension while it investigated a possible vulnerability, then urged them to shut down their servers and took its own hosted installations offline.

LNbits provides software for operating Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls. The reported attacks therefore concern installations used to manage payments and balances, rather than a reported failure of Bitcoin itself or the wider Lightning network.

Cointelegraph reported that LNbits creator Ben Arc said both users and the project had suffered losses. One operator, Kevin Ravensberg, reported that attackers withdrew approximately 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut down his server. That account does not establish the incident's total losses or the number of installations affected.

The project's recovery guidance extends beyond installing the patch. LNbits told administrators to reset all wallet keys, explaining that existing keys would stop working and users would need to update connected applications and integrations. It also instructed operators to revoke and replace credentials at their funding sources, then update the corresponding settings.

Other sensitive credentials stored in LNbits settings should also be treated as compromised, the project said. Operators were additionally told to revoke existing extension connections and create replacements using updated credentials. Those instructions make replacing potentially exposed access a separate recovery task from correcting the software vulnerability.

For installations suspected of being compromised, LNbits recommended using a fresh server with version 1.7.0 installed. It asked operators to preserve relevant logs and records before replacing the old server, warning that an upgrade cannot by itself remove access an attacker may already have obtained.

LNbits also stressed the exposure associated with hot wallets, where credentials needed to spend funds are available to an online system. Its guidance was to retain only day-to-day operating funds online, review balances and outgoing payments regularly, and move excess funds to an onchain wallet with spending keys kept offline.

The project said a separate report would provide full details of the exploit. Until that disclosure, the precise attack mechanism remains unresolved in its public guidance, while the immediate response centers on upgrading affected installations and replacing potentially compromised access credentials.