Bitcoin Lightning wallet platform LNbits has released version 1.7.0, an urgent security update issued in the wake of a major security incident that prompted cautionary shutdown notices for users. According to the project, the release is a critical security package addressing vulnerabilities, authentication, payment processing, and extension management, and operators are being urged to take action as soon as possible. All LNbits users are advised to upgrade to v1.7.0 as a matter of urgency.

LNbits is free, open-source software that runs on top of Lightning Network node backends such as LND and Core Lightning, providing account and wallet management for operators and their users. The platform can be extended with plug-in modules, including the Paywall extension that featured in the events leading up to the update. Because each LNbits instance manages wallets on behalf of multiple users, a flaw in the software can translate directly into losses for the people holding balances on it — which is why the project's upgrade call is aimed at every deployment.

LNbits Pushes Emergency Upgrade After Reported Losses

The update follows a warning issued by LNbits on Nov. 8, when the team told operators to take down their servers amid burst attacks. Earlier that same day, the team had asked users to turn off the Paywall extension so it could investigate a possible vulnerability. The roughly two-day gap between those warnings and the patched release gives a sense of how quickly operators of public-facing wallet infrastructure need to move once a flaw comes under attack.

Ben Arc, the creator of LNbits, later admitted that losses had been incurred by both users and the project, and that the days before v1.7.0 were especially hard.

The project announced the release in a post on X on November 10:

🚨SECURITY UPDATE🚨 v1.7.0 is now released Please follow the upgrade guidance in the notes.

— LNbits (@lnbits) November 10, 2026

https://x.com/lnbits/status/2120254437419622696?ref_src=twsrc%5Etfw

At least one operator has publicly reported the loss of approximately 2.29 million satoshis — around 0.023 BTC — after unauthorized users were registered on an LNbits instance and funds were withdrawn. The project has not yet published a complete tally of losses suffered by all affected operators.

Upgrading Alone May Not Be Enough

LNbits has cautioned that upgrading alone may not protect every operator. According to the project, an operator at risk is one whose credentials may already have been compromised, and there is always a possibility that wallet keys, funding credentials, or other secrets remain valid even after the wallet software is patched. Users who believe their instance has been compromised should change their credentials and may want to rebuild the instance on a new server. The advice reflects a reality familiar to open-source financial software: closing the code vulnerability stops new exploitation, but it does not by itself neutralize secrets that may have already been exposed.

The distinction is significant because the issue does not lie with Bitcoin or the Lightning Network protocol, but with LNbits software deployments.

v1.7.0 Adds 2FA, BOLT12 and On-Chain Wallet Support

Beyond the security fixes, v1.7.0 is a substantial feature release. The release notes on GitHub detail new functionality including TOTP two-factor authentication, on-chain wallet support, BOLT12 offer payments, NIP-17 support, a job scheduler, and automatic extension updates. Of these, TOTP two-factor authentication — a time-based code required alongside a password — stands out given the update's focus on authentication and account access. The release also contains numerous fixes for payment notifications, Lightning backends, fiat wallets, and Wasm Extensions.

Payment-related fixes address duplicate processing of BOLT12 retries, Core Lightning fee calculation, and the accounting of service fees for LND self-payments. The announcement also covers software upgrades, moving LNbits to Python 3.13 and Pydantic 2, along with additional security enhancements.

For operators, however, the new functionality is not the top priority. LNbits is making a specific call to action, urging all current deployments to upgrade to v1.7.0 before resuming normal operation. The release notes remain the definitive reference for that process, and any further accounting of losses from the project will be the figure to watch as the community assesses the aftermath.

Source: CryptoNinjas