LNbits, the open-source Lightning Network wallet and accounts platform, released version 1.7.0 on November 10 as an urgent security update, instructing all operators to upgrade before restarting their servers. The project's official X account announced the release with a link to the GitHub release, labeling it a “SECURITY UPDATE”.

The patch responds to a wave of attacks that began over the weekend. On November 8, LNbits posted on X that all users should stop their LNbits servers immediately after reporting active attacks, adding that security patches were being prepared and that it was “better to err on the side of caution.” The project also disabled instances on its hosted service.

Multiple reports documented unauthorized account creation and fund withdrawals. Kevin Ravensberg, operator of the Telegram tipping service BitTipBot, publicly stated that attackers created new accounts on his instance and withdrew 2,285,545 satoshis (approximately 0.0229 BTC) between roughly 09:22 and 14:00 UTC on November 8.

According to the official upgrade guidance published alongside the release, all versions prior to 1.7.0 are affected, and “funds running on prior versions of LNbits are at risk of being stolen.” The project said 1.7.0 contains security fixes addressing the incident discovered on November 8 and that a full technical report on the exploit will follow. Because LNbits provides multi-user accounts and extensions on top of a single funding source, the update's importance extends past individual operators to the users of unpatched instances, whether self-hosted or managed, whose balances depend on the software running beneath them.

Operators who suspect compromise are advised to set up a fresh server, since updating alone cannot remove access an attacker may already have gained. Additional recovery steps include rotating all user wallet keys as Super Admin, replacing funding-source credentials (API keys or macaroons), rotating other secrets stored in settings, and reviewing or re-creating connections for extensions such as NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA.

The GitHub release notes describe extensive security hardening across authentication, extension management, and payment handling, along with dependency updates. The version also ships new features, including on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates, and hold invoice support for the LNbits funding source.

The project reminds operators that LNbits functions as a hot wallet: only operational balances should be kept online, activity should be reviewed regularly, and excess funds should be moved to offline keys — standard operating practice for any Lightning service holding funds online.

LNbits was founded in 2019 by Ben Arc as a free and open-source project and later incorporated a commercial entity to support development. The software provides multi-user accounts and a large suite of extensions on top of any Lightning funding source, including LND and Core Lightning. Bitcoin Magazine profiled the project in September 2024, describing it as “the WordPress for your Bitcoin Lightning node” and noting its widespread use by individuals, businesses, and node operators seeking accessible Lightning tooling. It is widely deployed both self-hosted and through managed instances.

As of the v1.7.0 announcement, the project has not published an aggregate total of funds lost across all affected instances, and the promised technical report on the exploit has yet to appear — two threads that will shape the full picture of the incident. Operators who have not yet upgraded are directed to the official guidance before bringing their servers back online.

This post, LNbits Releases 1.7.0 Urgent Security Update After November 8 Attacks Drain Funds, first appeared on Bitcoin Magazine and was written by Juan Galt.