LNbits released version 1.7.0 on November 10 as an urgent security update, instructing operators to install the patch before restarting servers. The open-source Lightning wallet and accounts platform issued the update in response to attacks against LNbits instances that began on November 8, prompting the project to immediately tell users to stop their servers and disable every instance on its hosted service. The project confirmed that all versions before 1.7.0 are affected and that funds running on prior builds are at risk of theft, with a full technical report on the exploit to follow.
Attacks Beginning November 8 Prompted 2.29 Million Satoshi Loss Report
Attacks against LNbits instances began over the weekend on November 8, when the project publicly told users to stop their servers immediately while security patches were prepared. LNbits also disabled every instance on its own hosted service. Operator reports described unauthorized account creation followed by withdrawals from user balances. Kevin Ravensberg, who runs the Telegram tipping service BitTipBot, reported that attackers opened new accounts on his instance and pulled out 2,285,545 satoshis, roughly 0.0229 Bitcoin, between about 09:22 and 14:00 UTC on November 8. The project's official X account framed the November 10 release as a "SECURITY UPDATE" and pointed operators to the GitHub release notes for the full change list. The announcement stops short of naming the vulnerability, and no aggregate total of losses across affected instances has been published. SlowMist's incident log lists the same 2,285,545-satoshi figure as a single-instance loss case.
LNbits Recovery Guidance Requires Fresh Server Installation and Credential Rotation
The official upgrade guidance published with the release directs operators who suspect a breach to preserve logs and records first, then stand up a fresh server running version 1.7.0 rather than trusting the old machine. From the new server, the Super Admin should rotate every user wallet's private key, which invalidates the old key, and every connected app must be updated with the replacement. Funding-source credentials such as API keys or macaroons need to be revoked and reissued at the source, and other secrets stored in server settings should be rotated as well. Existing extension connections, including NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA, must be torn down and rebuilt with the new credentials. The release notes describe hardening across authentication, extension management and payment handling, plus dependency updates, though the specific change that closes the attack path is not yet public. Version 1.7.0 also ships new features: on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates and hold invoice support for the LNbits funding source.
FAQ
What happened to LNbits instances on November 8?
Attacks against LNbits instances began on November 8, with operators reporting unauthorized account creation followed by withdrawals from user balances. BitTipBot operator Kevin Ravensberg reported that attackers withdrew 2,285,545 satoshis from his instance between about 09:22 and 14:00 UTC on November 8. The project immediately told users to stop their servers and disabled every instance on its hosted service.
What steps must operators take to recover from a compromised LNbits server?
Operators who suspect a breach must preserve logs and records, then stand up a fresh server running version 1.7.0. From the new server, the Super Admin should rotate every user wallet's private key, revoke and reissue funding-source credentials such as API keys or macaroons, rotate other secrets stored in server settings, and rebuild existing extension connections with new credentials.
