Title: LNbits Urges All Operators to Stop Their Servers Immediately Amid Active Attacks
Summary: The LNbits project — a free, open-source suite of Bitcoin Lightning wallet tools that many people self-host — took the unusual step of telling every operator to shut their servers down immediately, after a wave of attacks and before most of the fixes are out. On November 8 at 12:33 PM UTC it posted a first, narrower warning: anyone running the Paywall extension should disable it right away while the project investigated a potential bug. About 80 minutes later, at 1:56 PM UTC, the call widened: “All LNbits users should stop their LNbits servers IMMEDIATELY,” because a number of security patches still had to be pushed. The project also switched off the hosted instances it runs on my.lnbits.com. The warning does not cover Lightning nodes or other wallet software. A concrete loss came from operator Kevin Ravensberg, who reported that an exploit used through new accounts had withdrawn 2,285,545 satoshis (about 0.023 bitcoin) from his server; per The Hacker News the attack on his instance ran from 09:22 to 14:00 UTC on November 8, starting well before the project’s first warning. As of November 9 the project had not named the abused extension, the first fixed version was not out, and a developer’s estimate put patches at “24-48hrs.” Until the patches land, anyone self-hosting LNbits should keep the server down; when it comes back, check for unexpected new accounts and withdrawals before resuming.
References: