Urgent LNbits Patch Sparks Mystery: Are Bitcoin Wallets Now at Greater Risk Than Ever?

Ever wonder if your Bitcoin wallet might need a shot of digital flu vaccine? LNbits, the popular Bitcoin Lightning wallet platform used by thousands, just dropped a critical update — and not a moment too soon. After enduring a relentless wave of cyber-attacks that made off with users’ funds, LNbits has urged everyone to upgrade to version 1.7.0 immediately. It’s one of those hair-on-fire moments in crypto security where you realize that upgrading isn’t just about shiny new features—it’s about plugging holes hackers are already exploiting. But here’s a kicker: just updating might not be the magic bullet if your credentials are already in the wrong hands. The whole ordeal got me thinking — in the wild west of crypto, is your wallet really safer after a patch, or are you just chasing shadows? Let’s dive into what went down, why this matters to anyone handling Bitcoin Lightning wallets, and what you need to do next to keep your digital treasure chest locked tight. LEARN MORE.

Bitcoin Lightning wallet platform LNbits has urged users to update immediately to its latest version after reporting a wave of attacks targeting LNbits instances that resulted in stolen funds.

The project published version 1.7.0 on Tuesday, describing it as a critical release addressing vulnerabilities and strengthening authentication, extension management and payment handling. LNbits warned that updating alone would not protect installations whose credentials had already been compromised.

“It’s been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses,” LNbits creator Ben Arc said on X.

LNbits provides software for running Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls. Developer Ben Arc said in May that about 200,000 people run the software themselves.

LNbits first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability. Just over an hour later, the project urged users to shut down their LNbits servers immediately, citing a wave of attacks. It also took its own hosted installations offline.

The company has not yet detailed the exploit and how many were impacted by it. In an announcement accompanying the emergency patch, LNbits said the vulnerability affects all versions before 1.7.0 and puts funds at risk of theft.

It also warned that credentials exposed before upgrading could still give attackers access afterward, urging operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised and recommended moving to a fresh server if a compromise is suspected.

Cointelegraph reached out to Ben Arc and LNbits for comment.

One user, Kevin Ravensberg, said attackers exploited his LNbits instance, withdrawing about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut down the server.

The company said a separate report detailing the exploit would follow.

Magazine: Bitcoin’s ‘best buying opportunity ever’ has arrived: Mark Moss