LNbits rushes emergency patch after reported Bitcoin wallet thefts

What happened

The project warned that installations running older versions were vulnerable and urged operators to replace potentially exposed credentials even after upgrading. LNbits warned that updating alone would not protect installations whose credentials had already been compromised.

LNbits first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability. Just over an hour later, the project urged users to shut down their LNbits servers immediately, citing a wave of attacks.

Related: BitMart founder says security team ‘severely understaffed’ after new hack It also warned that credentials exposed before upgrading could still give attackers access afterward, urging operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised and recommended moving to a fresh server if a compromise is suspected. Bitcoin Lightning wallet platform LNbits has urged users to update immediately to its latest version after reporting a wave of attacks targeting LNbits instances that resulted in stolen funds.

The project published version 1.7.0 on Tuesday, describing it as a critical release addressing vulnerabilities and strengthening authentication, extension management and payment handling. LNbits provides software for running Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls.

Developer Ben Arc said in May that about 200,000 people run the software themselves. It also took its own hosted installations offline.

The company has not yet detailed the exploit and how many were impacted by it. In an announcement accompanying the emergency patch, LNbits said the vulnerability affects all versions before 1.7.0 and puts funds at risk of theft.