LNbits, the open-source Lightning Network wallet and accounts platform, released version 1.7.0 on November 10 as an urgent security update and instructed all operators to upgrade before restarting their servers. The project’s official X account posted the announcement with a link to the GitHub release, calling it a “SECURITY UPDATE”.
The release follows a wave of attacks that began over the weekend. On November 8, LNbits posted on X that all users should stop their LNbits servers immediately after reporting active attacks, adding that security patches were being prepared and that it was “better to err on the side of caution.”
The project also disabled instances on its hosted service. Multiple reports documented unauthorized account creation and fund withdrawals.
Kevin Ravensberg, operator of the Telegram tipping service BitTipBot, publicly stated that attackers created new accounts on his instance and withdrew 2,285,545 satoshis (approximately 0.0229 BTC) between roughly 09:22 and 14:00 UTC on November 8.
According to the official upgrade guidance published alongside the release, versions prior to 1.7.0 are affected and “funds running on prior versions of LNbits are at risk of being stolen.” The project stated that 1.7.0 includes security fixes in response to the incident discovered on November 8 and that a full technical report on the exploit will follow.
Operators are advised to set up a fresh server if compromise is suspected, because updating alone cannot remove access an attacker may already have gained. Additional recovery steps include rotating all user wallet keys as Super Admin, replacing funding-source credentials (API keys or macaroons), rotating other secrets stored in settings, and reviewing or re-creating connections for extensions such as NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA.
The GitHub release notes describe extensive security hardening across authentication, extension management, and payment handling, plus dependency updates. New features shipping with the version include on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates, and hold invoice support for the LNbits funding source. The project notes that LNbits functions as a hot wallet and that operators should keep only operational balances online, regularly review activity, and move excess funds to offline keys.
LNbits was founded as a free and open-source project in 2019 by Ben Arc and later incorporated a commercial entity to support development. It provides multi-user accounts and a large suite of extensions on top of any Lightning funding source (including LND and Core Lightning). Bitcoin Magazine profiled the project in September 2024, describing it as “the WordPress for your Bitcoin Lightning node” noting its widepsread use by individuals, businesses, and node operators seeking accessible Lightning tooling. The software is widely deployed both self-hosted and via managed instances.
As of the v1.7.0 announcement, the project has not published an aggregate total of funds lost across all affected instances. Operators who have not yet upgraded are directed to the official guidance before bringing servers back online.
