LNbits Releases Security Update After Warning of Risk to Lightning Funds

LNbits released version 1.7.0 of its Bitcoin (BTC) Lightning payment software Nov. 10, giving operators a security fix after a vulnerability put funds on older installations at risk of theft.

The vulnerability was discovered Nov. 8 and affects every version before 1.7.0. The release became available at 12:09 p.m. ET (17:09 UTC) Nov. 10. LNbits told operators to install it before running their servers.

The release follows LNbits’ shutdown of every instance on its hosted service and its warning for independent operators to take their servers offline after attacks. LNbits provides hosted and independently operated wallet and payment tools used for checkout, donations and tipping.

An upgrade alone does not invalidate credentials that may have been exposed. “Credentials exposed before the upgrade may still give an attacker access afterwards,” LNbits said. Operators should reset all user wallet keys. They should also revoke or delete existing extension connections before creating new ones, revoke and replace funding-source credentials, and replace other stored secrets.

For a suspected compromise, LNbits recommends preserving logs and records from the old server before replacing it with a fresh server running version 1.7.0. The project plans to publish a separate account of the exploit.