LNbits released version 1.7.0 and urged operators to update after reporting attacks on its Bitcoin Lightning wallet software that stole funds. The project said the vulnerability affects all earlier versions, but warned that an update alone will not protect installations whose credentials were already exposed. It has not detailed the exploit or said how many installations were affected.
LNbits urged operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised. It recommended moving to a fresh server if a compromise is suspected. One user said attackers withdrew about 2.3 million satoshis, or 0.023 Bitcoin, from his instance.
