Bitcoin Lightning wallet platform LNbits has issued an emergency security update following a series of attacks that reportedly resulted in stolen funds. The project urged operators to upgrade immediately, warning that older versions of the software leave Bitcoin wallets exposed to potential theft.

Version 1.7.0, released on November 10, delivers fixes for critical vulnerabilities along with stronger security protections. Even so, developers cautioned that installing the update alone may not secure systems where attackers have already obtained sensitive credentials.

LNbits Alerts Operators Amid Ongoing Attacks

LNbits develops software that lets businesses and individuals run Bitcoin Lightning wallets and payment applications, supporting use cases such as merchant payments, tipping platforms, subscription systems, and digital paywalls.

The incident came to light on November 8, when LNbits warned operators about a possible vulnerability involving its Paywall extension. As the attacks continued, the project followed up with an urgent call for users to shut down their servers without delay. Hosted installations were also temporarily suspended to limit potential exposure.

Ben Arc, the project's creator, subsequently acknowledged that users and developers had suffered financial losses during the incident. According to LNbits' security guidance, every version released before 1.7.0 is vulnerable. Developers have not disclosed the exact attack mechanism, and the total financial damage has yet to be confirmed.

Reported Bitcoin Theft Draws Attention

Kevin Ravensberg, an operator affected by the incident, reported losing approximately 2.3 million satoshis, equivalent to about 0.023 BTC. He said attackers created unauthorized accounts and withdrew funds before he was able to shut down his server.

The reported loss highlights the security risks associated with self-hosted cryptocurrency payment infrastructure, where operators—not a central provider—are responsible for server security, key management, and credential handling. While Lightning Network transactions enable fast Bitcoin payments, compromised wallet software can expose funds to unauthorized withdrawals.

Patch Alone Is Not Enough, Operators Told

The latest LNbits security patch reinforces authentication, extension management, and payment processing. Version 1.7.0 also introduces additional protections, including two-factor authentication and improved wallet management features.

Nevertheless, LNbits warned that previously exposed credentials could remain usable even after installation. Unlike software flaws, which an update closes, stolen credentials do not expire when a server is upgraded. Operators must therefore reset wallet keys, replace funding-source credentials, and revoke any access permissions that may have been compromised. The project also recommends replacing sensitive information stored in application settings.

Operators who suspect their servers were compromised should consider deploying fresh installations rather than relying exclusively on the software update.

LNbits plans to publish a detailed technical report explaining the vulnerability and the attacks. Until then, the full extent of the losses remains unclear, leaving operators focused on securing their Bitcoin Lightning payment systems. The promised report—and any update on when the project's suspended hosted installations come back online—is the next development to watch.