Overview
The maintainers of LNbits, a free open-source Bitcoin Lightning wallet system, have told everyone running it to shut down their servers because of a wave of attacks. The project says it has several security fixes to release and asked operators to be careful until they ship.
Timeline
- The project first asked operators to disable Paywall, an add-on for paid content, while it investigated a possible bug.
- About 80 minutes later it issued the broader shutdown notice.
- One operator, Kevin Ravensberg, reported losing about 0.023 BTC (2,285,545 satoshis) from a server running BitTipBot, a Telegram bot. His server was exploited between 09:22 and 14:00 UTC, before either warning.
- The project also shut down its cloud-hosted instances (my.lnbits.com) and said service should return within 24 hours.
- Developer Ben Arc estimated patches would be merged and available within 24 to 48 hours.
What Is Known and Unknown
As of the report (09:00 UTC, November 9):
- The exact flaw is unconfirmed. Ravensberg said Arc and a security testing team identified which extension exploit was used, but neither named it, and it is not stated whether it is Paywall.
- No affected or fixed versions have been named, and no fixed release existed.
- The notice covers LNbits servers only, not Lightning nodes or other wallet software.
- The number of attacked servers and the total amount stolen are unknown.
- The project had not explained how operators could check whether they were already hit.
Guidance for Operators
- Shut down LNbits servers until patches are released.
- Watch the project's official channels for the fixed release and apply it before restarting.
- Review wallet balances and logs for unexplained transfers, and treat funds on exposed instances as at risk.
- Consider disabling optional extensions when you bring a server back online.
Users of affected services cannot reach their funds until the flaws are fixed.