LNbits, a free, open-source system for running Bitcoin Lightning wallets, has told everyone who operates a server to switch it off. On 8 November the project posted on X that all LNbits servers should be stopped immediately, saying it had “a number of security patches to push” after “a wave of attacks” and that it was better to be cautious until they were ready. The Hacker News reports that the notice came about 80 minutes after an earlier, narrower warning asking operators to disable Paywall, an add-on that charges people to view content.
At least one operator has reported a loss. Kevin Ravensberg, who runs the BitTipBot Telegram bot, said on X that his server was exploited before the shutdown notice and that 2,285,545 satoshis, about 0.023 bitcoin, were withdrawn, according to The Hacker News. The attack ran from 09:22 to 14:00 UTC on 8 November, more than three hours before the project’s first warning at 12:33 UTC, and Ravensberg said the attackers used newly created accounts. He has promised to repay his users, who cannot reach their funds until the flaws are fixed. The project has not named the extension that was exploited or said whether it is Paywall, and it has not said how many servers were hit or how much was taken in total. As of 09:00 UTC on 9 November The Hacker News saw no fixed version, and LNbits developer Ben Arc had estimated that patches would be available within 24 to 48 hours of his post. The project also switched off all the LNbits instances it runs for users on its hosted service, saying they would return within 24 hours.
How to check if you’re affected
Affected products are LNbits servers: the project’s notice is addressed to all operators and does not list specific versions. It does not mention Lightning nodes or other wallet software, so the notice, as reported, covers LNbits itself.
- If you run an LNbits server, stop it now, as the project asked, and do not turn it back on until the project publishes patches. Watch the official LNbits accounts on X for the release.
- If you only hold funds in someone else’s LNbits-powered wallet or bot, you cannot patch anything yourself. The service may be offline, and its operator is the one to ask.
- The project has not said how to tell whether a server was already exploited before it was shut down. The Hacker News notes it offered no such guidance as of its report. The one operator who reported a loss said the attackers used newly created accounts, so unexpected recent accounts and withdrawals are a reasonable thing to look for, but that is our reading of his report, not guidance from the project.
Sources
- The Hacker News: LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
- LNbits shutdown notice on X (the text of the post was readable; linked from The Hacker News)
- Kevin Ravensberg’s loss report and the LNbits patch estimate, both on X, are linked from The Hacker News article and were not read directly; their contents are as described by The Hacker News.