What happened
LNbits, an open-source Bitcoin Lightning wallet system, is being actively exploited in attacks. The reported exploitation took place before the flaw was publicly known. The project has urged operators to shut down LNbits servers amid the attacks and said that security fixes are available. The supplied patch status confirms that a fix is available; version details are not provided. One operator reported that attackers used new accounts to exploit a server and withdraw 2,285,545 satoshis, approximately 0.023 bitcoin, before the operator could respond. The report does not provide technical details of the flaw, the precise exploit method, or a CVSS score. No severity level has been published.
Who is affected
Organisations running LNbits are within the group identified by the project’s warning. The available information does not specify affected versions or whether particular configurations are excluded. The reported attack involved new accounts and the withdrawal of funds from an LNbits server; further details about the conditions required for exploitation are not available.
Recommended actions
- Shut down LNbits servers while the reported attacks are ongoing, in line with the project’s warning.
- Apply the available fix to affected LNbits deployments. The fixed version number is not provided, so consult project information to identify the applicable fix.
- Monitor new-account activity and withdrawals on affected deployments for activity consistent with the reported exploitation.
