The team behind LNbits, self-hosted Lightning Network wallet software, put out version 1.7.0 on November 10 after reports of bitcoin thefts tied to a flaw in its Paywall extension, the project said in a security notice.
The flaw affected all versions before 1.7.0: LNbits warned operators about it on November 8, pointing to the Paywall extension. Based on reports of the breach, it allowed attackers to create unauthorized accounts and move funds out through them; LNbits has not put a figure on the total losses.
LNbits advises operators to treat credentials that may have been exposed before the patch as potentially compromised, and recommends they:
- set up a new server instead of only updating the existing installation;
- cycle every wallet key from the Super Admin panel;
- replace funding-source credentials and reconnect external services, including NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA.
LNbits warned that hot wallets carry risk because whoever holds the keys to spend the money has a system sitting online, advising operators to keep minimal balances there and move the rest to cold storage.
One operator, Kevin Ravensberg, said he lost roughly 2.3 million satoshis, or about 0.023 bitcoin, because of the flaw. LNbits creator Ben Arc acknowledged the toll of the fix, saying: “It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses.”
Arc estimated in May that roughly 200,000 operators run LNbits on their own.
