LNbits, the open-source Lightning Network wallet and accounts platform, released version 1.7.0 on November 10 to address vulnerabilities exploited during a wave of attacks that began on November 8. All versions prior to 1.7.0 are considered vulnerable, and operators must update the software before restarting their servers. Multiple reports documented unauthorized account creation and fund withdrawals, including 2,285,545 satoshis, or approximately 0.0229 BTC, withdrawn from BitTipBot between about 09:22 and 14:00 UTC. Operators who suspect a compromise must establish a fresh server because the update alone cannot remove previously obtained access, then rotate wallet keys, funding credentials and other secrets. No aggregate total of losses across affected instances had been published when version 1.7.0 was announced.
Source: Read the original article
