LNbits Urges Server Shutdown Amid Active Exploitation of Bitcoin Lightning Wallet
LNbits, an open-source Bitcoin Lightning wallet system, has issued an urgent directive for all operators to shut down their servers due to active attacks exploiting an unspecified extension.
LNbits, a popular open-source Bitcoin Lightning wallet system, has issued an urgent warning to all its operators, instructing them to immediately shut down their servers. The directive comes in response to a wave of active attacks that have successfully exploited a vulnerability within an unspecified LNbits extension, leading to the theft of cryptocurrency.
One operator reported that attackers utilized the exploit to withdraw approximately 0.023 Bitcoin (2,285,545 satoshis) from their server before they could intervene. This incident prompted the project to issue a broader shutdown notice, following an initial, more targeted warning about a potential bug in the Paywall add-on.
As of the latest updates, the LNbits project has not yet released a fixed version of the software. Developers estimate that patches will be merged and available within the next 24 to 48 hours. In the interim, the project has taken the precautionary measure of disabling all LNbits instances it hosts on its cloud service, my.lnbits.com, with services expected to be restored within 24 hours.
The operator who experienced the loss, Kevin Ravensberg, stated that the attack on his server began before the project's initial warning and continued for several hours. He has committed to reimbursing affected users of his BitTipBot Telegram bot, who are currently unable to access their funds.
While Ravensberg and LNbits developers have confirmed the specific extension exploit used on his server, neither has publicly named the vulnerable extension. It remains unclear whether the exploited extension is the Paywall add-on mentioned in the project's first warning.
The shutdown advisory specifically targets LNbits servers and does not extend to other Lightning nodes or wallet software. The full extent of the attacks, including the total number of affected servers and the total amount of cryptocurrency stolen, has not yet been disclosed.
This incident highlights the critical importance of timely security updates and the potential impact of vulnerabilities in cryptocurrency wallet infrastructure. Users and operators are advised to remain vigilant and follow the official guidance from the LNbits project regarding the deployment of security fixes.