Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday.

It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could stop it.

The shutdown notice came about 80 minutes after a first, narrower warning. That warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug.

As of 09:00 UTC today, the project had not released a fixed version. On X, it had not canceled the notice, offered another option, or told operators how to check whether their servers were hit before they were shut down.

Ben Arc, an LNbits developer, said in a patch estimate yesterday that patches "should be merged and available within 24-48hrs." Counted from his post, that means between about 14:00 UTC today and 14:00 UTC tomorrow.

The project also switched off all the LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday. It said in a hosted-service notice that all services would be back within 24 hours, or by about 17:20 UTC today.

Kevin Ravensberg, the operator who reported the loss, said in a loss report on X that his server was exploited before the shutdown notice. The attack ran from 09:22 to 14:00 UTC yesterday, starting more than three hours before the project's first warning at 12:33 UTC.

Source link