LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks

Everyone running LNbits , a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.

It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, 0.023 bitcoin, from his server before he could stop it.

The shutdown notice came 80 minutes after a first, narrower warning. That warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug.

As of 09:00 UTC today, the project had not released a fixed version. On X, it had not canceled the notice, offered another option, or told operators how to check whether their servers were hit before they were shut down.

Ben Arc, an LNbits developer, said in a patch estimate yesterday that patches "should be merged and available within 24-48hrs." Counted from his post, that means between 14:00 UTC today and 14:00 UTC tomorrow.

The project also switched off all the LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday. It said in a hosted-service notice that all services would be back within 24 hours, or by 17:20 UTC today.

Kevin Ravensberg, the operator who reported the loss, said in a loss report on X that his server was exploited before the shutdown notice. The attack ran from 09:22 to 14:00 UTC yesterday, starting more than three hours before the project's first warning at 12:33 UTC.

He has promised to repay users of BitTipBot, a Telegram bot. They cannot reach their funds until the project fixes the flaws.

Later yesterday, Ravensberg said in a follow-up post that Arc and a team of security testers had confirmed "which exact extension exploit was used" on his server. Neither he nor the project had named that extension in posts on X as of 09:00 UTC today. The project also had not said whether it is Paywall, the add-on named in its first warning .

The shutdown notice covers LNbits servers and does not mention Lightning nodes or other wallet software. It did not say how many servers were attacked or how much was taken.