On November 8, the Bitcoin Lightning wallet system LNbits told all operators to shut down immediately, saying it was under attack. Two days later, on November 10 at 17:09 UTC, emergency update 1.7.0 was released. All versions before 1.7.0 were affected, and upgrading was required to go back online. Ordinary Bitcoin holders needn’t panic just yet.

The timeline is the most noteworthy part. The attack began at 09:22 UTC on November 8, but the project team didn’t issue its first warning until 12:33—and that only told users to disable the Paywall extension. About 80 minutes later, the warning was upgraded to an order for everyone to shut down. The attack started more than three hours before the warning. The project’s own hosted service also shut down later that day, saying it would be back within 24 hours—around 17:20 UTC on November 9—but no notice of its return had been issued even after that deadline passed.

One confirmed loss was reported by Kevin Ravensberg, operator of the Telegram tipping bot BitTipBot. Between 09:22 and 14:00 UTC, attackers used newly registered accounts to exploit a vulnerability in an extension and withdraw 2,285,545 sats—about 0.023 bitcoin, or roughly $1,700. He promised to reimburse users. That figure covers just one server; the total losses have not yet been announced.

A patch is out, but the investigation is still ongoing. As of 01:35 UTC on November 11, officials had not disclosed which extension was involved, how many people were affected, or whether there was a CVE. The key point: upgrading to 1.7.0 is only the first step. If you suspect your server was compromised, the official advice is to move to a new server, reset your wallet keys, rotate your API keys and other credentials, and recheck the extensions you have connected. An upgrade replaces the software, but if your keys and credentials have already leaked, attackers can still get in.

For retail users, the incident affected LNbits servers. The Lightning Network itself and other wallets were not affected. If you use a service hosted by someone else, avoid depositing funds there for now and wait until the operator announces that they have upgraded to 1.7.0. If you run your own node, upgrade to 1.7.0 first, then follow the four steps above to check your keys and credentials.

My take: the patch is good news, but the real lesson lies in the timeline.

Do you think the project team issued this warning in time?

#比特币 #闪电网络 #LNbits #钱包安全 #Hacked

— Web3 Bagholder Xiaokai

This content reflects personal opinions only and does not constitute investment advice. Please make your own judgment.