A pre-start version guard for self-hosted services (after the LNbits 1.7.0 advisory)

Raterix — Wed, 11 Nov 2026 04:38:54 +0000

On 8 November the LNbits team told operators to shut their servers down after attackers created unauthorized accounts and withdrew funds. One operator reported losing 2,285,545 sats. On 10 November, version 1.7.0 shipped as an urgent security update, with a clear instruction: upgrade before you restart.

That instruction is easy to break by accident. A systemd unit restarts after a reboot, a container comes back with an old image, and the vulnerable version is serving requests again before anyone checks.

Here is a small guard you can put in front of any self-hosted service: it reads the installed version, compares it with a minimum you set, and exits non-zero if the version is too old, so the service never starts.

The script

// version-guard.mjs
// usage: node version-guard.mjs <path-to-pyproject.toml> <min-version>
import { readFileSync } from 'node:fs';

const [file, min] = process.argv.slice(2);
if (!file || !min) {
  console.error('usage: node version-guard.mjs <pyproject.toml> <min-version>');
  process.exit(64);
}

const text = readFileSync(file, 'utf8');
const m = text.match(/^version\s*=\s*"([^"]+)"/m);
if (!m) {
  console.error(`no version line found in ${file}`);
  process.exit(65);
}

const parse = (v) => v.replace(/^v/, '').split(/[.-]/).slice(0, 3).map((n) => parseInt(n, 10) || 0);
const cmp = (a, b) => {
  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] - b[i];
  return 0;
};

const installed = m[1];
if (cmp(parse(installed), parse(min)) < 0) {
  console.error(`refusing to start: installed ${installed} < required ${min}`);
  process.exit(1);
}
console.log(`ok: installed ${installed} >= ${min}`);

Wire it into systemd

[Service]
ExecStartPre=/usr/bin/node /opt/guards/version-guard.mjs /opt/lnbits/pyproject.toml 1.7.0
ExecStart=/opt/lnbits/start.sh

If ExecStartPre fails, systemd doesn't run ExecStart. The unit fails, and you see it in systemctl status and your alerts.

Check it against the latest upstream release

To get told when upstream moves past your pin, compare with the GitHub releases API:

// latest-release.mjs
const res = await fetch('https://api.github.com/repos/lnbits/lnbits/releases/latest', {
  headers: { 'User-Agent': 'version-guard' },
});
const { tag_name } = await res.json();
console.log(tag_name);

Run it from cron and diff the output against your pinned minimum. A change means it's time to read the release notes.

Notes

The version parser handles 1.7.0, v1.7.0 and 1.7.0-rc1 (pre-release tags compare equal to the release; tighten it if that matters to you).
Point the guard at whatever file your install uses as the source of truth for its version.
A guard can only stop a restart. It does nothing for a server that is already running. When a project says "shut down now", shut it down first.

Sources: Bitcoin Magazine on LNbits 1.7.0, Crypto Briefing, Bitcoin.com News.

Watching every chain, not just the hot wallet: a small outflow monitor in Node

Raterix — Tue, 10 Nov 2026 05:18:20 +0000

On 2 November 2026 the Brazilian exchange Mercado Bitcoin paused deposits and withdrawals after funds moved out of wallets linked to it. According to CertiK, the attacker spent about four hours on eight smaller chains, including Base, Optimism and Arbitrum, before reaching the central hot wallets. Hypernative estimated the total outflow at about $40 million.

Four hours on side chains is a long window. If your alerting only watches the busiest wallet, that's time you don't see. Here's a small script that watches outgoing native transfers from a list of addresses on several EVM chains and flags anything over a threshold.

It uses only Node 18+ (built-in fetch) and public JSON-RPC endpoints. Swap in your own RPC URLs and addresses.

// outflow-watch.mjs (run: node outflow-watch.mjs)
const CHAINS = {
  base: 'https://mainnet.base.org',
  optimism: 'https://mainnet.optimism.io',
  arbitrum: 'https://arb1.arbitrum.io/rpc',
};
// addresses you operate (lowercase)
const WATCH = new Set([
  '0x0000000000000000000000000000000000000000',
]);
const THRESHOLD_ETH = 0.5;

async function rpc(url, method, params) {
  const r = await fetch(url, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
  });
  const j = await r.json();
  if (j.error) throw new Error(`${method}: ${j.error.message}`);
  return j.result;
}

const last = {};

async function scan(name, url) {
  const head = parseInt(await rpc(url, 'eth_blockNumber', []), 16);
  const from = last[name] ?? head; // start at the head on first run
  for (let n = from + 1; n <= head; n++) {
    const block = await rpc(url, 'eth_getBlockByNumber', ['0x' + n.toString(16), true]);
    for (const tx of block.transactions) {
      if (!tx.from || !WATCH.has(tx.from.toLowerCase())) continue;
      const eth = Number(BigInt(tx.value)) / 1e18;
      if (eth >= THRESHOLD_ETH) {
        console.log(`[ALERT] ${name} block ${n}: ${eth} ETH from ${tx.from} to ${tx.to} (${tx.hash})`);
      }
    }
  }
  last[name] = head;
}

async function loop() {
  for (const [name, url] of Object.entries(CHAINS)) {
    try { await scan(name, url); } catch (e) { console.error(name, e.message); }
  }
}

await loop();
setInterval(loop, 15_000);

A few notes on taking this further:

Native transfers are only part of it. ERC-20 outflows show up as Transfer logs, so add an eth_getLogs call filtered on the Transfer topic with your addresses as the from topic.
Fast chains produce a lot of blocks. For production, use eth_getLogs over ranges, or a provider's webhook, rather than pulling full blocks one at a time.
Alert on rate as well as size. Many small transfers from many addresses can matter more than one big one. In this incident, CryptoTicker reported small amounts swept from about 27,160 addresses into one.
Give every chain the same thresholds and on-call routing. The smaller chain is often where nobody is looking.

What does your team monitor on the chains that see the least traffic?