Urgent Patch Issued After Lightning Node Exploit Drains Funds

An open-source Lightning Network accounts platform deployed an emergency security update on November 10 following a weekend of active exploits. The software provider, LNbits, instructed all server operators to install version 1.7.0 before bringing their nodes back online, designating the release as a “SECURITY UPDATE” on social media.

The rapid patch deployment comes after unauthorized actors breached the platform to generate new accounts and withdraw user funds. On November 8, LNbits administrators directed all network participants to shut down their servers immediately while patches were developed, stating it was “better to err on the side of caution.” The project also deactivated instances running on its own managed hosting service.

While the developers have not yet disclosed the aggregate amount of missing assets across the network, individual operators have reported distinct losses. Kevin Ravensberg, who runs the BitTipBot tipping application on Telegram, disclosed that attackers breached his instance on November 8 between roughly 09:22 and 14:00 UTC. During this window, the malicious actors created fresh accounts and siphoned 2,285,545 satoshis, equivalent to approximately 0.0229 BTC.

Server Overhauls and Credential Rotation

Official guidance accompanying the 1.7.0 release warned that “funds running on prior versions of LNbits are at risk of being stolen.” The development team emphasized that simply applying the software update is insufficient for any node that has already been breached, as the patch cannot revoke access previously established by attackers.

If an operator suspects a compromise, they are advised to deploy an entirely fresh server. Essential recovery procedures dictate that administrators operating as Super Admin must rotate all user wallet keys. They must also swap out funding-source credentials, including macaroons and API keys, alongside any additional secrets housed in the platform's settings. Furthermore, operators need to meticulously review or rebuild all connections tied to integrated extensions, such as Bleskomat, FOSSA, TPOS, NWC Provider, Bolt Cards, and LNDHub.

Hardening and Added Capabilities

The GitHub release documentation outlines comprehensive security enhancements focusing on extension management, payment processing, and authentication frameworks, alongside dependency updates. In addition to sealing the exploit vectors discovered on November 8, version 1.7.0 ships with new functionalities. These additions feature on-chain wallet support, two-factor authentication via TOTP, BOLT12 offer payments, an automated job scheduler, automatic extension updates, NIP-17 integration, and hold invoice support.

Founded by Ben Arc as a free initiative in 2019, LNbits operates on top of funding sources like Core Lightning and LND. The software provides multi-user functionalities and a broad array of extensions, profiled by Bitcoin Magazine in September 2024 as “the WordPress for your Bitcoin Lightning node.” The platform's maintainers reiterated that the software is inherently a hot wallet, advising operators to store only necessary operational balances online, monitor activity, and periodically sweep excess assets to offline storage. A comprehensive technical breakdown of the vulnerability is expected to follow.