LNbits Ships Urgent 1.7.0 Security Update After November 8 Attacks

LNbits, the open-source Lightning wallet and accounts platform, released version 1.7.0 on November 10 as an urgent security update, instructing all operators to install the patch before bringing their servers back online. The project's official X account described the release as a "SECURITY UPDATE" and directed operators to the GitHub release notes for the complete change list.

Founded in 2019 by Ben Arc as a free and open-source project, LNbits offers multi-user accounts and a broad suite of extensions on top of any Lightning funding source, including LND and Core Lightning. It is deployed both as self-hosted installations and through managed instances.

Attacks Began on November 8

The incident timeline began over the weekend. On November 8, the project publicly urged users to shut down their servers immediately, stating it preferred to err on the side of caution while security patches were being prepared. LNbits also disabled every instance on its own hosted service.

Operator reports described unauthorized account creation followed by withdrawals from user balances. Kevin Ravensberg, who operates the Telegram tipping service BitTipBot, reported that attackers opened new accounts on his instance and withdrew 2,285,545 satoshis — roughly 0.0229 Bitcoin (BTC) — between approximately 09:22 and 14:00 UTC on November 8.

According to the official upgrade guidance published alongside the release, every version prior to 1.7.0 is affected, and funds running on earlier builds are at risk of theft. The team confirmed that 1.7.0 contains fixes responding to the incident discovered on November 8 and said a full technical report on the exploit will follow. The announcement does not name the vulnerability, and no aggregate total of losses across affected instances has been published.

Rotating Keys and Rebuilding Compromised Servers

Installing the patch and recovering from a compromise are separate tasks. LNbits warned that updating does not automatically revoke any access an attacker may already have obtained, meaning an upgraded server can remain unsafe if it was touched during the attack window. The guidance directs operators who suspect a breach to preserve logs and records first, then deploy a fresh server running 1.7.0 rather than trusting the old machine. Retaining those records matters for later forensics, as the promised technical report will draw on evidence of the attack path.

From the new server, the Super Admin should rotate every user wallet's private key, which invalidates the old key, and every connected app must be updated with the replacement. Funding-source credentials such as API keys or macaroons need to be revoked and reissued at the source, and other secrets stored in server settings should be rotated as well. Existing extension connections — including NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA — must be torn down and rebuilt with the new credentials.

What Version 1.7.0 Changes

The release notes describe hardening across authentication, extension management and payment handling, along with dependency updates, though the specific change that closes the attack path has not yet been made public. Version 1.7.0 also introduces new features: on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates and hold invoice support for the LNbits funding source.

SlowMist's incident log lists the same 2,285,545-satoshi figure as a single-instance loss case, and the announcement makes no claim of any compromise of the Bitcoin network or the Lightning protocol itself. Confirmed damage so far sits with operator servers, not the protocol layer.

According to COINOTAG, the undisclosed root cause is the sharpest edge of this story. LNbits operates as a hot wallet by design, and the official guidance tells operators to keep only operational balances online while moving excess funds to offline keys. Until the promised technical report identifies the attack path, every unpatched or freshly upgraded instance should be treated as a potential target — the reason the patch ships alongside a complete credential-rotation procedure.

The original report was published by COINOTAG.