LNbits Tells All Bitcoin Lightning Wallet Operators to Shut Down Servers as Attacks Hit

The LNbits project, which makes a free, open-source Bitcoin Lightning wallet system, has told all operators to shut down their servers because of a wave of attacks. It has several security fixes to release and asked operators to be careful until they are out. About 80 minutes earlier, it had issued a narrower warning to disable Paywall, an add-on that makes people pay to view content. As of 09:00 UTC today, no fixed version had been released.

One operator, Kevin Ravensberg, reported that new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server. He said the attack ran from 09:22 to 14:00 UTC yesterday, starting more than three hours before the project's first warning. He has promised to repay users of BitTipBot, a Telegram bot, though they cannot reach their funds until the flaws are fixed. The project also switched off all instances it hosts on its cloud service, my.lnbits.com, and expects them back within 24 hours.

Many questions remain open. The extension used in the attack has not been named publicly, and the project has not said whether it is Paywall. It also has not said how many servers were attacked, how much was taken, or how operators can check whether they were hit. Developer Ben Arc estimated patches would be available within 24 to 48 hours. The notice covers LNbits servers and does not mention Lightning nodes or other wallet software.