LNbits Urges Operators to Upgrade After Bitcoin Wallet Theft Reports

LNbits has released version 1.7.0 as an emergency security update after attacks on installations of the open-source Lightning wallet platform were reported over the weekend. The project's warning is broad: every version before 1.7.0 is affected, and funds held on those versions may be at risk.

For operators, the advice is not simply “install the patch.” LNbits says credentials exposed before upgrading could remain usable afterward. Its recovery guidance calls for rotating wallet keys, funding-source credentials and other secrets, and recommends a fresh server when compromise is suspected.

The project has not yet published technical details of the exploit, a count of affected installations or an aggregate loss figure. One operator has publicly described a loss, but that account should not be mistaken for a network-wide total.

What LNbits disclosed

The LNbits security update, dated 10 November, says the vulnerability was discovered on 8 November and that all versions earlier than 1.7.0 are affected. It instructs operators to install 1.7.0 before running LNbits again. The project says a separate report will provide more detail on the exploit.

The release followed public warnings on 8 November. LNbits first told operators to disable its Paywall extension while it investigated a potential vulnerability. A little over an hour later, it urged all operators to shut down their servers amid reports of attacks, and took its own hosted installations offline as a precaution.

On 10 November, the project said it had released 1.7.0 and described recent days as challenging, noting that users and the team had suffered losses. The GitHub release notes list security hardening across authentication, extension management and payment handling. They do not, by themselves, establish the precise vulnerability or explain how attackers exploited it.

One operator's reported loss is not a total

Cointelegraph reported that Kevin Ravensberg, who operates the BitTipBot Telegram tipping service, said attackers created new accounts on his LNbits instance and withdrew about 2.3 million satoshis—roughly 0.023 Bitcoin—before he could shut the server down. That is one operator's account, not a confirmed tally of all losses.

Bitcoin Magazine also reported the incident and the same approximate amount, drawing on Ravensberg's public account. LNbits has not said how many instances were affected or published a combined loss number. Until its promised technical report arrives, the scope and exact mechanism remain unresolved.

That distinction matters because LNbits is software operators run alongside Lightning funding sources. A problem in an instance can expose the funds and credentials connected to that operator's deployment, but one reported loss cannot show how widespread the incident was.

Why upgrading alone may not be enough

LNbits warns that information exposed before the update could still give an attacker access afterward. Replacing the software closes the known vulnerable-version issue, but it does not automatically invalidate wallet keys, API credentials, macaroons or other secrets that may already have been copied.

The project recommends preserving relevant logs and records, installing version 1.7.0 on a fresh server if compromise is suspected, and resetting user wallet keys through the Super Admin settings. Operators should also revoke and replace credentials at their funding source, then update those credentials in LNbits.

Other secrets stored in LNbits settings should be treated as exposed, according to the guidance. Existing connections for extensions and integrations should be reviewed and recreated using updated credentials. These are operationally disruptive steps, but leaving a potentially compromised credential active can undermine the patch.

What operators should do now

Operators should follow LNbits' own recovery instructions rather than rely on an unverified forum fix or copied checklist. In practical order:

• Keep an affected server offline until it has been upgraded to version 1.7.0.
• Preserve logs before rebuilding, especially if compromise is suspected.
• Prefer a fresh server for a suspected compromise, then install the fixed version.
• Reset wallet keys and replace funding-source credentials and other stored secrets.
• Recreate extension connections with new credentials and inspect outgoing payments.

A server that was never exposed still needs the version update because the project says all pre-1.7.0 versions are affected. If an operator cannot confidently identify what secrets were exposed, the conservative course is to rotate them rather than assume they remain safe.

What users of hosted services should know

The incident concerns LNbits installations and their operators; public disclosures do not establish that every Lightning wallet or every LNbits user was affected. LNbits previously said it disabled its hosted installations as a precaution. The project has not published a complete incident accounting or a full technical explanation as of 11 November.

Users should be cautious about unsolicited messages offering recovery help. They should use the operator's verified channels for service-status information and avoid sharing seed phrases or credentials with anyone claiming to assist. Where an operator confirms a compromise or asks users to update access details, follow that operator's verified instructions.

A security update, with important unknowns

LNbits 1.7.0 is a necessary response, but it is not a complete incident report. The confirmed guidance is clear: update before restarting, and rotate access material that may have been exposed. What remains unknown is the exploit's technical root cause, the total number of affected instances and the total value of losses.

The project says further details will follow. Until then, operators should treat the advisory as a serious version-wide warning, complete credential rotation as well as patching, and avoid presenting individual reports as the full scale of the incident.