LNbits Tells Every Server Operator to Shut Down Pending Patches
The Lightning account system's developers say fixes should land in 24 to 48 hours. LNbits has not named the flaw or said how many servers were hit.
LNbits told everyone running its software to stop their servers immediately on Sunday, saying a wave of attacks had left it with security patches still to push. Contributor Ben Arc said the fixes should be merged and available within 24 to 48 hours.
The project's 8:56 a.m. ET post on X asked users to stop servers "IMMEDIATELY" and said, "it's better to err on the side of caution." Arc added three minutes later that operators should pass the warning on to anyone who might be running an instance. At 12:18 p.m. ET, LNbits said it had switched off every instance on its own hosted service as a precaution and expected services to resume within 24 hours.
From one extension to every server
The warning widened through the morning. At 7:33 a.m. ET, LNbits had asked operators with its Paywall extension enabled to turn it off while it investigated "a potential bug." The 8:56 a.m. post covered every server, with or without that extension.
How LNbits works
LNbits is open-source software that sits on top of a Lightning node and lets one operator give separate wallets to many users, with add-on extensions for things like paywalls and tipping. Because each server is connected to a node holding real bitcoin, a flaw in LNbits can reach that money. That's why the project is asking operators to stop servers rather than wait for a patch.
A loss one operator reported
Kevin Ravensberg, who runs the LNbits server behind the BitTipBot Telegram tipping bot, said newly created accounts withdrew 2,285,545 sats, about 0.023 bitcoin, from his server on Sunday before he stopped it, Bitcoin.com News reported. It said he plans to cover the bot's users himself. We could not independently confirm the figure.
What isn't known
LNbits has not said what the vulnerabilities are, whether the Paywall bug is among them, how many servers were attacked, or how much was taken in total. Its latest tagged release on GitHub is v1.6.2 from Sept. 18, and no new security advisory was listed when we checked at 6 p.m. ET.
Operators who stopped their servers should keep them off until a fixed release is published and LNbits says it is safe to restart.
Sources: LNbits on X: stop all servers (Nov. 8) · Ben Arc on X: patches within 24-48 hours (Nov. 8) · LNbits on X: Paywall extension precaution (Nov. 8) · LNbits on X: hosted instances disabled (Nov. 8) · Bitcoin.com News: Lightning Network Security Scare Forces LNbits Servers Offline · LNbits GitHub releases
Revisions
First published .
No revisions since publication.
We fix errors and say so. See every correction on the Blackmint corrections page.