LNbits Urges Upgrade And Key Resets After Security Exploit
LNbits says operators need version 1.7.0 and replacement credentials because an upgrade alone may leave attackers with access.
LNbits has told operators to upgrade to version 1.7.0 before running its software after a vulnerability was discovered on 8th November. In its 10th November security notice, the project warned that funds on older versions remained exposed to theft and that credentials obtained before an upgrade could still give an attacker access afterwards.
LNbits is open-source software for managing wallets and accounts using a Lightning funding source, the underlying service or node that moves the funds. Its operators can run the service for themselves or provide accounts to others. The warning therefore concerns the servers running those accounts, as well as the applications connected to them.
The GitHub release record dates version 1.7.0 to 17:09 UTC on 10th November. LNbits describes it as a critical security release, with fixes and changes to authentication, payment handling and extension management. Extensions add functions to the software.
Updating Alone May Leave Access Open
LNbits recommends a new server where compromise is suspected, preserving logs before replacing the old one.
The recovery instructions also call for resetting every user's wallet access keys, revoking and replacing credentials at the funding source, and replacing other sensitive credentials stored in settings. Existing wallet access keys stop working after the reset, so connected applications need the replacements.
Operators are also told to remove existing extension connections and create new ones with updated credentials. These instructions do not certify the security of an individual server. The keys being reset are LNbits API credentials that control access to its wallet accounts. Our wallet guide explains who can authorise wallet transactions.
An Operator Reports Withdrawals
In a public account on 8th November, Kevin Ravensberg said new accounts had used the exploit to withdraw 2,285,545 satoshis (0.02285545 bitcoin) from his LNbits instance before he could stop the server. He identified the affected service as the instance supporting BitTipBot and said he would reimburse its users.
That is the operator's own account of withdrawals and a repayment promise. It does not establish a total loss across LNbits deployments or completed reimbursement. The project's upgrade notice promises a separate report explaining the exploit.
Our report on Keplr's recovery disclosures covers another incident in which recovery announcements and the interpretation of transfers needed to be kept distinct.
