LNbits Ships 1.7.0 Urgent Security Update After November 8 Attacks

Urgent 1.7.0 Patch Follows November 8 Attacks

LNbits, the open-source Lightning wallet and accounts platform, shipped version 1.7.0 on November 10 as an urgent security update and instructed every operator to install it before bringing servers back online. The project’s official X account framed the release as a “SECURITY UPDATE” and pointed operators to the GitHub release notes for the full change list. Founded in 2019 as a free and open-source project by Ben Arc, LNbits provides multi-user accounts and a large suite of extensions on top of any Lightning funding source, including LND and Core Lightning, and is deployed both self-hosted and through managed instances.

The timeline matters. Attacks against LNbits instances began over the weekend: on November 8 the project publicly told users to stop their servers immediately, saying it preferred to err on the side of caution while security patches were prepared. LNbits also disabled every instance on its own hosted service. Operator reports described unauthorized account creation followed by withdrawals from user balances. Kevin Ravensberg, who runs the Telegram tipping service BitTipBot, reported that attackers opened new accounts on his instance and pulled out 2,285,545 satoshis, roughly 0.0229 Bitcoin (BTC), between about 09:22 and 14:00 UTC on November 8.

According to the official upgrade guidance published with the release, every version before 1.7.0 is affected and funds running on prior builds are at risk of theft. The team confirmed that 1.7.0 contains fixes responding to the incident discovered on November 8 and said a full technical report on the exploit will follow. The announcement stops short of naming the vulnerability, and no aggregate total of losses across affected instances has been published.

Rotating Keys and Rebuilding Compromised Servers

Installing the patch and recovering from a compromise are separate jobs. LNbits warned that updating does not automatically revoke whatever access an attacker may already have obtained, so an upgraded server can remain unsafe if it was touched during the attack window. The guidance directs operators who suspect a breach to preserve logs and records first, then stand up a fresh server running 1.7.0 rather than trusting the old machine. Preserving those records matters for any later forensics, since the promised technical report will draw on evidence of the attack path.

From the new server, the Super Admin should rotate every user wallet’s private key, which invalidates the old key, and every connected app must be updated with the replacement. Funding-source credentials such as API keys or macaroons need to be revoked and reissued at the source, and other secrets stored in server settings should be rotated as well. Existing extension connections, including NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA, must be torn down and rebuilt with the new credentials.

The release notes describe hardening across authentication, extension management and payment handling, plus dependency updates, though the specific change that closes the attack path is not yet public. Version 1.7.0 also ships new features: on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates and hold invoice support for the LNbits funding source. SlowMist’s incident log lists the same 2,285,545-satoshi figure as a single-instance loss case, and the announcement is silent on any compromise of the Bitcoin network or the Lightning protocol itself; confirmed damage so far sits with operator servers, not the protocol layer.

COINOTAG’s reading: the root cause is still undisclosed, and that gap is the sharpest edge of this story. LNbits operates as a hot wallet by design, and the official guidance tells operators to keep only operational balances online while moving the excess to offline keys. Until the promised technical report names the attack path, every unpatched or freshly upgraded instance should be treated as a live target, which is why the patch ships alongside a full credential-rotation procedure. For excess balances, cold storage such as the Tangem Mobile Wallet takes the server out of the trust chain entirely, and our overview of protecting crypto assets covers the same principle from the user side.