LNbits Launches Urgent 1.7.0 Security Patch Following November 8 Attacks

Bitcoin Magazine

LNbits, the open-source platform for Lightning Network wallets and accounts, pushed out version 1.7.0 on November 10, calling it an urgent security fix. All operators were told to upgrade before restarting their servers. The project's official X account shared the announcement and linked to the GitHub release, flagging it as a “SECURITY UPDATE”.

The rollout follows a spate of attacks that kicked off over the weekend. On November 8, LNbits posted on X that all users should shut down their LNbits servers right away after detecting active attacks, adding that security fixes were in the works and that it was “better to err on the side of caution.”

The project also deactivated instances on its hosted service. Multiple reports described unauthorised account creation and fund withdrawals.

Kevin Ravensberg, who runs the Telegram tipping service BitTipBot, said publicly that attackers created fresh accounts on his instance and pulled out 2,285,545 satoshis (roughly 0.0229 BTC) between about 09:22 and 14:00 UTC on November 8.

According to the official upgrade guidance put out alongside the release, all versions before 1.7.0 are vulnerable and “funds running on prior versions of LNbits are at risk of being stolen.” The project said 1.7.0 includes security fixes triggered by the incident discovered on November 8 and that a full technical report on the exploit will come later.

Operators are told to set up a new server if they suspect a compromise, since updating alone cannot remove access an attacker might already have. Additional recovery steps include rotating every user wallet key as Super Admin, replacing funding-source credentials such as API keys or macaroons, rotating other secrets kept in settings, and reviewing or rebuilding connections for extensions like NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA.

The GitHub release notes describe extensive security hardening across authentication, extension management, and payment handling, along with dependency updates. New features in this version include on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates, and hold invoice support for the LNbits funding source. The project says LNbits acts as a hot wallet and that operators should keep only operational balances online, review activity regularly, and transfer excess funds to offline keys.

LNbits was started as a free and open-source project in 2019 by Ben Arc and later formed a commercial entity to fund development. It offers multi-user accounts and a large set of extensions on top of any Lightning funding source, including LND and Core Lightning. Bitcoin Magazine featured the project in September 2024, calling it “the WordPress for your Bitcoin Lightning node” and noting its broad use by individuals, businesses, and node operators looking for accessible Lightning tools. The software is widely deployed both as self-hosted and managed instances.

As of the v1.7.0 announcement, the project has not released a total of funds lost across all affected instances. Operators who have not yet upgraded are pointed to the official guidance before bringing servers back online.