LNbits Creator Says Project and Users Suffered Losses in Attacks

The creator of LNbits, Ben Arc, said the project and its users suffered losses during attacks on its Bitcoin (BTC) Lightning wallet software as LNbits urged operators to install an emergency security update.

“It’s been a very challenging few days,” Arc said, describing the work to release version 1.7.0 after the project and its users suffered losses.

LNbits released version 1.7.0 Tuesday to address a flaw affecting all earlier versions. The project warned that funds managed by those installations were at risk of theft.

Updating does not by itself protect a server if credentials were exposed before installation. LNbits urged operators to reset wallet keys and replace funding-source credentials, and to treat secrets saved in settings as compromised. Operators who suspect a compromise should move to a fresh server, the project said.

The release also strengthens authentication, extension management and payment handling. LNbits told operators Sunday to disable its Paywall extension while it investigated a potential vulnerability, then urged them to shut down servers after citing a wave of attacks. It also took its hosted installations offline.

LNbits software lets operators host Lightning wallets and payment apps for merchant checkout, tipping and paywall services. The project said a separate account of the exploit would follow, without specifying when.