LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks

Summary: The LNbits project told all operators of its open-source Bitcoin Lightning wallet system to shut down their servers yesterday after a wave of attacks, roughly 80 minutes after an initial warning to disable the Paywall add-on while it investigated a possible bug. One operator, Kevin Ravensberg, reported that new accounts used an exploit to withdraw 2,285,545 satoshis (about 0.023 bitcoin) from his server in an attack that ran from 09:22 to 14:00 UTC, starting more than three hours before the project's first warning at 12:33 UTC, and as of 09:00 UTC today no fixed version had been released.
Why it matters: The exploit was already draining funds for over three hours before operators got any warning, and the project still had not named the extension involved or said how many servers were hit - so any operator who has not shut down has no way to know yet whether their server was among them.

Read the original at The Hacker News ↗