LNbits tells operators to upgrade now after a wave of attacks on its Lightning wallet software

LNbits, open-source software that lets people run Bitcoin Lightning Network wallets and accounts on their own servers, released version 1.7.0 on November 10 as an urgent security update after a wave of attacks that it reported on November 8. Operators must not run LNbits again until they have installed 1.7.0, the project said in its upgrade guidance, warning that on any older version, funds "are at risk of being stolen."

What happened

On November 8, at 12:33 UTC, LNbits told operators to switch off its Paywall extension while it investigated a possible bug. About 80 minutes later, it told all users to stop their LNbits servers immediately "following a wave of attacks," saying it had security patches to release. Later that day it disabled all instances on its hosted service, my.lnbits.com, as a precaution.

The project published version 1.7.0 on GitHub on November 10, describing it as a critical release with security hardening and vulnerability fixes, and urging everyone running LNbits to update immediately. The release also adds features such as two-factor authentication.

LNbits has not yet described how the attacks worked; it says a separate report with full details of the exploit will follow.

What the LNbits security update asks operators to do

The upgrade guidance asks for more than installing the update, because updating alone "cannot remove access an attacker may already have gained," the project says. If operators think their server was broken into, LNbits wants them to build a new one running 1.7.0 instead of patching the old machine, and to save its logs first. For every operator, the guidance also lists further steps: issue new wallet keys to all users, which cuts off apps connected with the old keys until they are set up again; get new credentials for the Lightning node or payment service behind the instance; assume that every other secret saved in the LNbits settings has leaked; and rebuild extension links, such as those used by Bolt Cards, LNDHub and TPOS, from scratch.

The losses so far

LNbits has not published a figure for total losses. Kevin Ravensberg, who runs the Telegram tipping service BitTipBot, said on X that attackers created new accounts on his LNbits instance and withdrew 2,285,545 satoshis, about 0.023 BTC, on November 8. Trading Notified could not independently confirm the figure.

What it could mean for users

LNbits notes that it is a hot wallet, meaning the keys that move money are held on an internet-connected machine. Its guidance tells operators to limit what they hold in LNbits to what daily use requires, to check balances and outgoing payments regularly, and to keep the rest in an on-chain wallet with offline keys. LNbits' guidance is addressed to operators; it gives no separate instructions to people whose funds sit in wallets on someone else's LNbits server. LNbits' warning is one of several security incidents between November 8 and 10: Binance warned of an iOS flaw it says could expose wallet keys, and Across Protocol said its website domain had been hijacked.