LNbits released update 1.7.0 after Bitcoin theft attacks

The developers of LNbits, a software platform for managing Bitcoin wallets and payments through the Lightning Network, have released an emergency security update 1.7.0 following a series of attacks that led to the theft of user funds. The new version was published on November 10, 2026, and includes vulnerability fixes, as well as changes to authentication mechanisms, extension management, and payment processing.

According to the project's official warning, the vulnerability affects all versions of LNbits up to 1.7.0. However, the update itself does not guarantee the security of installations if attackers have already gained access to confidential keys and other credentials.

LNbits Developers Warned of Attacks on November 8

The first warnings appeared on November 8, when the LNbits team recommended disabling the Paywall extension, designed for organizing paid access to content. Just over an hour later, the developers reported a series of attacks and urged operators to immediately shut down LNbits servers. The project also temporarily disabled its own hosted services.

LNbits creator Ben Arc reported on social network X that the preparation of the update was carried out under difficult conditions. "It has been a very tough few days. We have been working non-stop to release version 1.7 after both our users and we ourselves suffered losses," the developer wrote.

LNbits is used to create Bitcoin wallets and payment applications, including payment acceptance systems, tipping, and paid access services. In May, Ben Arc estimated the number of people independently running this software at about 200,000. However, this estimate does not reflect the number of those affected by the current attacks.

One case was reported by user Kevin Ravensberg. According to him, attackers exploited a vulnerability in his LNbits installation and withdrew about 2.3 million satoshis, or 0.023 BTC, through newly created accounts before he managed to shut down the server.

Update Does Not Eliminate Risk of Using Stolen Keys

LNbits warned that previously compromised credentials might remain valid even after installing the patched version of the program. Therefore, developers recommend operators reset wallet access keys, replace funding source credentials, and update other confidential information stored in the settings.

Additionally, it is recommended to check connections of third-party applications and extensions. If there are suspicions that the server was compromised, developers advise installing LNbits 1.7.0 on a new server, after saving necessary event logs and data for investigation.

The exact mechanism of the vulnerability exploitation has not yet been disclosed. The total number of affected installations and the overall amount of stolen funds are also unknown. The LNbits team plans to publish a separate technical report with details of the incident.