Bitcoin Lightning wallet platform LNbits has urged users to update immediately to its latest version after reporting a wave of attacks on LNbits instances that resulted in stolen funds.

The project published version 1.7.0 on Tuesday, two days after the first public warnings, describing it as a critical release that addresses vulnerabilities and strengthens authentication, extension management and payment handling. LNbits warned, however, that updating alone would not protect installations whose credentials had already been compromised.

"It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," LNbits creator Ben Arc said in a post on X that was also shared on Nostr.

LNbits provides software for running Bitcoin Lightning wallets — built on the Lightning Network, Bitcoin's layer for fast, low-cost payments — as well as payment applications, including merchant checkouts, tipping services and paywalls. Because LNbits is designed to be run on operators' own servers, the security of each installation depends on the individual running it. Arc said in May that around 200,000 people run the software themselves.

LNbits first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability. Just over an hour later, the project urged users to shut down their LNbits servers immediately, citing a wave of attacks, and took its own hosted installations offline.

In an announcement accompanying the emergency patch, LNbits said the vulnerability affects all versions before 1.7.0 and puts funds at risk of theft. The company has not yet detailed the exploit or how many operators were affected, and said a separate report laying out the details of the exploit would follow. Until that report arrives, the overall scale of losses across self-run instances remains undisclosed.

LNbits also cautioned that credentials exposed before upgrading could still give attackers access afterward. It urged operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised, and recommended moving to a fresh server if a compromise is suspected.

One user, Kevin Ravensberg, said attackers exploited his LNbits instance and withdrew about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut the server down.

Cointelegraph reached out to Ben Arc and LNbits for comment.