LNbits Releases Emergency Patch Following Reported Bitcoin Wallet Thefts

The Bitcoin Lightning wallet platform LNbits has urged its user base to update their software immediately to version 1.7.0 following a wave of attacks that resulted in stolen funds. Users searching for information on the LNbits wallet often rely on the platform to manage merchant checkouts, tipping services, and various payment applications. The project confirmed that the new release addresses critical vulnerabilities related to authentication, extension management, and payment processing.

Addressing the LNbits security breach

Following reports of unauthorized access, the project initially advised operators on Sunday to disable its Paywall extension. Shortly thereafter, the team urged users to shut down their servers entirely as the scope of the attacks became clear. The project also took its own hosted installations offline as a precautionary measure. According to Ben Arc, the creator of the platform, the team has been working to resolve the issue after both users and the project itself suffered financial losses.

Operators must update to version 1.7.0 and reset all potentially compromised credentials to secure their funds.

While version 1.7.0 patches the identified vulnerabilities, the project warned that simply applying the update is insufficient if an installation was already compromised. Attackers who gained access to credentials before the patch could potentially maintain that access. Consequently, the team has advised operators to reset wallet keys, replace funding-source credentials, and treat all secrets stored in settings as compromised. In cases where a breach is suspected, the project recommends migrating to a fresh server instance.

One user, Kevin Ravensberg, reported that attackers exploited his instance to withdraw approximately 2.3 million satoshis, or 0.023 Bitcoin, by creating new accounts before he could successfully take the server offline. While the company has not yet released a detailed technical report on the exploit, it has promised that a full explanation will follow. As of May, developer Ben Arc estimated that approximately 200,000 people were self-hosting the software.

Why it matters

The project warned that installations running older versions were vulnerable and urged operators to replace potentially exposed credentials even after upgrading. This incident highlights the significant security risks associated with self-hosted Bitcoin infrastructure and underscores the necessity for users to remain vigilant regarding server maintenance and credential management.