The Bitcoin Lightning Network wallet platform LNbits is urging users to update immediately to the latest version after the project reported a wave of attacks on LNbits instances resulting in stolen funds.
The project released version 1.7.0 on Tuesday, describing it as a critical update that fixes vulnerabilities and enhances authentication, extension management, and payment processing. LNbits warned that even after updating, the installation environment will not automatically be secure if credentials were previously compromised.
Ben Arc, founder of LNbits, said on X: "The past few days have been extremely difficult—we and our users have suffered losses, and we've been working tirelessly to push out version 1.7 as soon as possible."
LNbits provides software for running Bitcoin Lightning Network wallets and payment applications, including merchant point-of-sale systems, tipping services, and paywalls. In May of this year, developer Ben Arc stated that approximately 200,000 people run this software themselves.
LNbits initially warned operators on Sunday to disable its Paywall extension while investigating a potential vulnerability. More than an hour later, the project urged users to immediately shut down their LNbits servers due to a wave of attacks and took down its self-hosted instances.
The company has not yet detailed how the vulnerability was exploited or disclosed the number of affected users. In an announcement accompanying the emergency patch, LNbits stated that the vulnerability affects all versions prior to 1.7.0 and puts funds at risk of theft.
LNbits also warns that credentials exposed prior to the upgrade may still allow attackers access after the upgrade, and urges operators to reset wallet keys, replace funding source credentials, and treat all keys stored in LNbits settings as compromised; if a breach is suspected, it is recommended to migrate to a completely new server.
Cointelegraph has reached out to Ben Arc and LNbits for comment.
User Kevin Ravensberg reported that attackers exploited his LNbits instance, withdrawing approximately 2.3 million satoshis, or 0.023 BTC, through newly created accounts before he was able to shut down the server.
The company stated that a separate report will be released later, providing detailed information about this exploit.