Bitcoin Lightning Wallet Platform LNbits Hit by Hack, Urges Emergency Security Update

Bitcoin Lightning Network wallet platform LNbits urged users to install an emergency security update after a series of hacking attacks resulted in stolen funds.

Cointelegraph reported on Nov. 10 that LNbits released software version 1.7.0 the same day to address the vulnerability and asked all operators to update immediately. The update includes measures to strengthen security for user authentication, extension management and payment processing.

LNbits developer Ben Arc wrote on X that users and the team had suffered losses over the past few days and had been working intensely to roll out version 1.7. LNbits is software that lets users build wallets and payment services on the Bitcoin Lightning Network. It is used for online payments, tips and paid content services.

Earlier, on Nov. 8, LNbits warned that a security issue may have been discovered in Paywall, a payment-related extension, and instructed users to disable the feature. As attacks continued, it asked operators about an hour later to shut down their servers immediately and temporarily closed its hosted service.

LNbits said the vulnerability affects all versions prior to 1.7.0 and could lead to stolen funds. It also said that if credentials had been exposed before the update, attackers might still be able to gain access even after the latest version is installed.

The company urged operators to replace wallet access keys and credentials tied to funding sources. It said any secrets stored in settings should be treated as compromised. If a server may already have been breached, operators should consider migrating to a new server environment.

At least one case of losses has been reported. LNbits user Kevin Ravensberg claimed an attacker created a new account on his server and withdrew about 2.3 million satoshis, or 0.023 BTC. He said the funds were drained before he shut the server down.

LNbits has not disclosed the specific vulnerability used in the attacks or the total scale of losses so far. The company said it plans to publish a separate report on how the hack unfolded and the findings of its security investigation.