LNbits, a platform for running Bitcoin Lightning wallets and payment applications, has urged users to upgrade immediately to its latest release after a wave of attacks on LNbits instances resulted in stolen funds.

The project published version 1.7.0 on Tuesday, describing it as a critical release that addresses vulnerabilities and strengthens authentication, extension management and payment handling. LNbits cautioned, however, that updating alone will not protect installations whose credentials have already been compromised.

“It’s been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses,” LNbits creator Ben Arc said on X.

What LNbits does

LNbits provides software for running Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls. Arc said in May that about 200,000 people run the software themselves. That figure describes operators running the software on their own infrastructure, which makes upgrading and rotating credentials a per-instance task — and explains why the release shipped alongside explicit cleanup guidance for existing installations.

How the incident unfolded

LNbits first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability. Just over an hour later, the project urged users to shut down their LNbits servers immediately, citing a wave of attacks, and also took its own hosted installations offline.

In an announcement accompanying the emergency patch, which arrived two days after that first warning, LNbits said the vulnerability affects all versions before 1.7.0 and puts funds at risk of theft — meaning any deployment still on an earlier release remains exposed until it is upgraded. The project has not yet detailed the exploit or how many operators were affected.

Steps for operators

LNbits warned that credentials exposed before upgrading could still give attackers access afterward. It urged operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised, and recommended moving to a fresh server if a compromise is suspected.

One user, Kevin Ravensberg, said attackers exploited his LNbits instance, withdrawing about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut the server down.

LNbits said a separate report detailing the exploit would follow. Cointelegraph reached out to Ben Arc and LNbits for comment (original report).