LNbits tells all operators to shut down servers after attacks

Updated 8 November, 18:45 UTC. LNbits switched off every instance on its hosted service, my.lnbits.com, and the BitTipBot operator says the exploited extension has been identified.

The LNbits project told everyone running its software to stop their servers immediately on Sunday. Its post on X at 13:56 UTC said that, following a wave of attacks, it has a number of security patches to push, and that operators should stay offline until then. LNbits developer Ben Arc added three minutes later that the patches should be merged and available within 24 to 48 hours.

LNbits is a free, open-source accounts system that runs on top of a Lightning node and lets one operator hand out separate wallets to many users, with add-on extensions for things like paywalls, point-of-sale and tipping. Because each instance is connected to a node, a flaw in LNbits can reach the money in that node.

Hosted service switched off

At 17:18 UTC LNbits said it had disabled all instances on its own hosted service, my.lnbits.com, as a precaution, and that all services would resume within 24 hours. Customers of the hosted service cannot reach their wallets until then.

From one extension to every server

The warning grew within 90 minutes. At 12:33 UTC LNbits asked operators with the Paywall extension enabled to disable it while it investigated a potential bug. The 13:56 post widened that to every LNbits server, whether or not Paywall is installed, and spoke of attacks rather than a bug.

One operator's loss

Kevin Ravensberg, who runs the LNbits instance behind the Telegram tipping bot BitTipBot, replied to the warning that his server was exploited before it went out. He says 2,285,545 sats, about 0.023 bitcoin, were withdrawn by newly created accounts between 09:22 and 14:00 UTC, before he could stop the server. He says he will make all of the bot's users whole, but they cannot reach their funds until LNbits patches the vulnerabilities.

He later added that an LNbits red team and Ben Arc had confirmed which extension exploit was used against his server, and that a way to prevent this kind of attack is being worked on. He did not name the extension.

The attack he describes started more than three hours before the first LNbits warning and ran until just after the second.

What is not known

LNbits has not said what the vulnerabilities are, which extension was exploited, whether the Paywall bug is one of them, how many instances were attacked or how much was taken in total. The project's GitHub security advisories list nothing new, no CVE has been published, and the newest release is still v1.6.2 from September 18. Until a fixed release appears, the project's advice is to keep every instance switched off.