LNbits Releases 1.7.0 Urgent Security Update Following November 8 Attacks
Key Takeaways
- •LNbits shipped version 1.7.0 on November 10 as an urgent security update after attacks targeted LNbits instances on November 8.
- •The project instructed every operator to install version 1.7.0 before bringing any affected server back online.
- •LNbits is a free, open-source Python application for self-hosting wallet and account systems on the Lightning Network, supporting multiple users, invoicing, and extensions such as point-of-sale and tip-jar tools, with connections to funding sources including LND and Core Lightning.
- •Since there is no central provider for the self-hosted platform, each administrator is responsible for applying the update, and account holders rely on their operators to act.
- •The announcement omitted technical details about the attacks, including the method of compromise and the number of instances affected, with any further disclosures expected through the project's official channels.
LNbits, the open-source Lightning wallet and accounts platform, shipped version 1.7.0 on November 10 as an urgent security update and instructed every operator to install it before bringing servers back online.
The directive followed attacks on LNbits instances on November 8. The project's official X account framed the release as a "SECURITY UPDATE" in a post announcing the version.
What LNbits Is
LNbits is a free, open-source application written in Python that runs on top of the Lightning Network, Bitcoin's layer-2 payment protocol. It enables individuals, businesses, and communities to self-host wallet and account systems, with support for multiple users, invoicing, and an extension framework that adds tools such as point-of-sale and tip-jar functionality. The platform can connect to several Lightning funding sources, including LND and Core Lightning.
Because LNbits is most often deployed by self-hosted operators rather than through a central hosted service, upgrade guidance is typically delivered directly to server administrators through the project's official communication channels, including its X account. That deployment model also shapes how a security incident plays out: there is no central provider to push fixes on users' behalf, so responding to an urgent release like 1.7.0 falls to each individual administrator — and anyone holding an account on an LNbits instance is effectively relying on their operator to act on the advisory.
Operator Instructions
According to the announcement, installation of version 1.7.0 should be completed before any affected server is brought back online. In practical terms, the release is the project's designated remediation step following the November 8 incidents, and instances still running earlier versions have not yet met the stated condition for resuming service.
The announcement summarized here did not include additional technical details about the November 8 attacks, such as the method of compromise or the number of instances affected. Any further disclosures — whether technical details, additional advisories, or follow-up guidance — would come through the project's official communication channels, the same venues through which operators received the upgrade directive, making those channels the natural place to watch as the situation develops.
This content was first published on COINOTAG: https://en.coinotag.com/lnbits-1-7-0-urgent-security-update-november-8-attacks
