lnbits

Has the LNbits patch arrived? There’s activity in the repository, but no official “you can restart” yet

This morning, we reported that LNbits officially asked all operators to shut down their services immediately. As of tonight, here are the facts we’ve been able to verify (Beijing time):

1. Two fixes were merged into GitHub’s main branch today, both titled as strengthening SSRF protection: around 20:26, “Centralize SSRF protection and block requests targeting the server itself”; around 22:22, “Strengthen SSRF checks and make local LNURL routing explicitly opt-in.”
2. Around 22:44, the repository was tagged v1.7.0-rc2. RC means release candidate; the latest version on GitHub’s official Releases page is still v1.6.2 from September.
3. The latest post on the official X account is still the one from around 01:18 on November 9: hosted service instances have been shut down, with a claim that they would be restored within 24 hours. There have been no new announcements since.

What is SSRF? It’s when an attacker tricks your server into accessing an address it shouldn’t, such as the server itself or an internal network.

To be clear: the official team hasn’t said these two fixes are the security patches in question. They haven’t disclosed vulnerability details, the number affected, or any losses—and they haven’t said it’s safe to restart. Activity in the repository doesn’t mean the all-clear has been given.

If you’re an operator: keep your service shut down and wait for an official announcement and release notes before taking action. Don’t install “fix packages” from unverified sources, and don’t trust people who contact you out of the blue offering help.

#LNbits #闪电网络 #Security

LNbits tells everyone to shut down immediately: With self-hosted security, are you on your own?

If you run your own LNbits instance, shut it down for now, then read this.

LNbits is an open-source Lightning Network wallet/account system. Many people use it to offer wallets and accept payments for others on their own servers. On November 8 (Beijing time), its official X account posted several warnings in quick succession:
1. Around 20:33: All operators with the Paywall extension enabled were told to turn it off immediately while the team investigated a potential vulnerability.
2. Around 21:56: The warning was broadened to “all LNbits users: stop your LNbits servers immediately,” citing “an ongoing attack.” A batch of security patches was in the works, and the team advised erring on the side of caution until they were ready.
3. Around 01:18 on November 9: All instances on the official hosted service had already been shut down, with service expected to return within 24 hours.

As of around 07:00 on November 9 (Beijing time), the team had not disclosed details of the vulnerability, the number of affected instances, or any losses. There was also no new patched version on GitHub.

A few things to keep in mind:
- This is an issue with the LNbits software, not a breach of Bitcoin or the Lightning Network itself.
- If you have funds in an LNbits instance run by someone else, contact the operator. Don’t trust anyone who messages you out of the blue offering to “help you recover” them.
- If you operate an instance yourself: shut it down for now, wait for the official patch and guidance, then decide how to bring it back online.

The benefit of self-hosting is not having to rely on others. The trade-off is that when something goes wrong, you’re the first one who has to take action.

#闪电网络 #LNbits #自托管 #Security

💥The open-source Lightning Network wallet and payments platform, #LNbits , issued an emergency shutdown warning after receiving multiple reports of security breaches. Operators were ordered to disconnect their servers immediately.

🚨 LNbits has recently suffered multiple attacks. Operator KevinR4 reported that attackers created new accounts and withdrew 2,285,545 sats in about 5 hours. The team has issued an urgent security warning, advising all users to shut down their servers immediately until a patch is released. ⏳ The fix is expected to be ready within 24–48 hours. In the meantime, affected BitTipBot funds remain unavailable, and the team has promised to compensate users afterward. 🛡️ This is a reminder that lightweight payment layers still require close monitoring and a rapid response. For now, we can only confirm that an attack occurred, the amount lost, and the expected timeline for a fix. It remains unclear whether there are any undiscovered vulnerabilities or further losses. Has anyone had a similar experience or have any security recommendations?

This is not investment advice.

#LNbits #Bitcoin #安全 #Write2Earn

Bitcoin is trading at USD 76,000, a level it has fallen below twice and held above three times since February, with two days to go before the U.S. releases October inflation data.

 From LNbits, software for Lightning wallets, asked all its users to shut down their servers following a “wave of attacks” and announced several security patches. An LNbits operator reported the withdrawal of 2,285,545 sats (USD 1,700).

LNbits suffers a “wave of attacks”

Electrum released version 4.8.4, its fifth security update since last July. The team fixed a vulnerability that allowed malformed messages from the Lightning Network (LN) to disconnect the wallet from its channel peer.

#Electrum修复4 #lightningnetwork #LNbits #EEUU #BTC $BTC