LNbits, an open-source accounts platform and Lightning Network wallet, pushed out version 1.7.0 on November 10 as an urgent security patch, directing all operators to complete the upgrade prior to server restarts. The announcement came via the project’s official X account alongside a link to the GitHub release, designating the software drop as a “SECURITY UPDATE.”
The patch arrives in the wake of malicious exploits that surfaced over the weekend. On November 8, LNbits used X to warn all users to halt their servers immediately following reports of active attacks, noting they were crafting security fixes and that it was “better to err on the side of caution.”
Instances hosted by the project were also taken offline. Numerous accounts detailed incidents of unauthorized account creation paired with drained funds.
BitTipBot operator Kevin Ravensberg shared publicly that perpetrators generated new accounts on his Telegram tipping platform instance, stripping away 2,285,545 satoshis—roughly 0.0229 BTC—between the hours of 09:22 and 14:00 UTC on November 8.
Official upgrade instructions released with the patch confirm that releases preceding version 1.7.0 are vulnerable, warning that “funds running on prior versions of LNbits are at risk of being stolen.” LNbits explained that version 1.7.0 addresses the security flaw uncovered on November 8, promising a comprehensive technical breakdown of the exploit at a later date.
Administrators who believe their systems were breached are urged to deploy an entirely new server, as simply updating the software fails to revoke persistent access an attacker may have established. Further recovery procedures mandate rotating every user wallet key as Super Admin, swapping out funding-source credentials such as API keys and macaroons, cycling other settings-stored secrets, and thoroughly auditing or rebuilding connections for extensions like NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA.
According to GitHub release logs, the update introduces rigorous security fortifications spanning payment management, authentication, and extension controls, alongside dependency upgrades. Fresh capabilities packaged into this release consist of on-chain wallet functionality, TOTP two-factor authentication, BOLT12 offer payments, NIP-17 compatibility, automated extension patches, a task scheduler, and hold invoice capability for the LNbits funding source. The team reiterated that because LNbits operates as a hot wallet, administrators must limit online balances to operational funds, routinely audit activity, and transfer surplus capital to offline keys.
Launched originally in 2019 as a free, open-source initiative by Ben Arc, LNbits eventually formed a commercial entity to back its ongoing expansion. The platform delivers multi-user functionality and an extensive library of extensions built over any Lightning backend, including Core Lightning and LND. In September 2024, *Bitcoin Magazine* featured the platform, calling it “the WordPress for your Bitcoin Lightning node” and highlighting its popularity among individuals, node operators, and businesses looking for accessible Lightning tools. The application sees broad deployment across both self-hosted setups and managed environments.
At the time of the v1.7.0 rollout, the team had not disclosed a cumulative sum for the capital stolen across impacted servers. Operators who have yet to patch their systems are instructed to review the official directives before firing up their servers again.
Frequently Asked Questions
What is LNbits?
LNbits is an open-source Lightning Network wallet and accounts platform founded in 2019 that provides multi-user accounts and extensions on top of Lightning funding sources.
Why was LNbits version 1.7.0 released?
It was released as an urgent security update on November 10 following active attacks and fund thefts that began on November 8.
Are versions prior to 1.7.0 at risk?
Yes, versions prior to 1.7.0 are vulnerable, and funds running on those older versions are at risk of being stolen.
What additional recovery steps are recommended if a server is compromised?
Operators should set up a fresh server, rotate user wallet keys as Super Admin, replace funding-source credentials, rotate other secrets, and audit extension connections.
