LNbits Issues Emergency Security Patch After Reports of Bitcoin Theft

LNbits releases emergency update to stop Bitcoin thefts

LNbits, a platform used to run Bitcoin Lightning wallets, has released a critical security update after users reported that their funds were stolen. The project's developers urged all operators to install version 1.7.0 immediately to fix vulnerabilities that put digital assets at risk. A Lightning wallet is a tool used to send and receive Bitcoin through the Lightning Network, a system built on top of the Bitcoin blockchain to make transactions faster and less expensive.

The project's creator, Ben Arc, described the past several days as "very challenging" while the team worked to address the security flaws. The new update aims to improve how the software handles payments, manages extensions, and identifies users.

Crucial security steps for wallet users

• Install version 1.7.0 immediately to patch the security hole.
• Reset all wallet keys and credentials for funding sources.
• Treat any sensitive information stored in the software settings as potentially compromised.
• If you suspect your server was accessed, move your setup to a completely fresh server.

Timeline of the security breach

The security concerns began on Sunday when LNbits advised its users to disable a feature called the Paywall extension. Shortly after, the project warned users to shut down their servers entirely as a wave of attacks targeted different installations. LNbits also took its own hosted services offline while investigating the reports.

As of earlier this year, approximately 200,000 people were estimated to be running the LNbits software to manage merchant checkouts, tipping services, and other payment applications.

Confirmed details and reported losses

The developers confirmed that every version of the software released before version 1.7.0 is vulnerable to the exploit. While the total amount of Bitcoin stolen across the network is not yet known, individual users have begun reporting their losses. One operator reported that attackers were able to create new accounts on their server and withdraw approximately 0.023 Bitcoin, which is roughly 2.3 million satoshis.

Future report on the exploit

While the emergency patch is now available, the exact technical details of how the attackers gained access remain unclear. The team at LNbits stated that they will publish a separate, detailed report explaining the exploit in the near future.

Sources

• Cointelegraph

Read also: Dormant Bitcoin Wallets Wake Up After 16 Years to Move $6.9 Million