LNbits has released version 1.7.0 as an urgent security update after a wave of attacks drained Bitcoin from wallet instances running the open-source Lightning software. The project says every version before 1.7.0 is affected and has told operators to upgrade before restarting their servers.

The emergency release, published on Tuesday 10 November, fixes the vulnerabilities behind the attacks and strengthens authentication, extension management and payment handling. LNbits has warned that installing the update alone will not protect an installation whose credentials were already compromised.

Attacks began on 8 November

The incident began on Sunday 8 November. At about 12:33 UTC, LNbits warned operators to disable its Paywall extension while it investigated a possible vulnerability. Just over an hour later, at about 13:56 UTC, the project told every operator to shut down their LNbits servers immediately, citing a wave of attacks. It also took its own hosted service, my.lnbits.com, offline.

The clearest confirmed loss so far comes from Kevin Ravensberg, operator of the Telegram tipping service BitTipBot. He reported that attackers created new accounts on his LNbits instance and withdrew 2,285,545 satoshis, about 0.023 Bitcoin, between 09:22 and 14:00 UTC on 8 November. He has pledged to reimburse affected users, but the funds remain out of reach until the security fixes are in place.

LNbits has not yet disclosed how the attackers exploited the software, and it has not published a total figure for funds lost across all affected instances. A full technical report on the exploit is expected to follow, according to Cointelegraph.

Upgrade is not enough on its own

The most important part of the recovery advice is that updating does not automatically make a compromised server safe. LNbits says operators should reset user wallet keys as Super Admin, replace funding-source credentials such as API keys and macaroons, and treat every other secret stored in LNbits settings as compromised.

Operators should also review or re-create connections for extensions including NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA. If a compromise is suspected, the project recommends moving to a completely fresh server rather than trying to clean the existing one.

"It has been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," LNbits creator Ben Arc said on X, as reported by Bitcoin Magazine.

What LNbits is and who uses it

LNbits is free, open-source software for running Bitcoin Lightning Network wallets and payment applications, including merchant checkouts, tipping services and paywalls. Ben Arc said in May that about 200,000 people run the software themselves. Because each operator runs their own server, there is no central switch the project can use to protect every installation, so each operator must hear the warning and act on it.

The project pushed a v1.6.0 security release in September 2026 following an audit by V12. Version 1.7.0 also adds new features, including on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates and hold invoice support for the LNbits funding source.

Until the update is installed and credentials are rotated, LNbits says funds running on earlier versions remain at risk of being stolen. Operators should upgrade to 1.7.0, complete the credential rotation steps, and wait for the project's technical report before treating any previously exposed installation as safe.