LNbits Issues Urgent v1.7.0 Security Update Following Fund Drains

The open-source Lightning Network wallet and accounts platform LNbits has released version 1.7.0 as an urgent security update following a wave of attacks that began over the weekend. Operators have been instructed to upgrade their software before restarting any servers, as prior versions leave funds vulnerable to theft. The project issued initial warnings on November 8, advising users to halt their servers immediately after discovering active attacks and noting that it was better to err on the side of caution while patches were prepared. At the same time, the project temporarily disabled instances operating on its hosted service.

Understanding the LNbits Security Incident

Multiple reports confirmed unauthorized account creation and fund withdrawals during the exploit. Kevin Ravensberg, who operates the Telegram tipping service BitTipBot, reported that attackers created unauthorized accounts on his instance and withdrew over two million satoshis between roughly 09:22 and 14:00 UTC on November 8. Official upgrade guidance warns that all variants prior to version 1.7.0 remain affected, stating that any funds handled on older iterations are at risk of being stolen. A comprehensive technical report detailing the exploit is scheduled to follow.

Operators must upgrade their software before restarting servers to prevent ongoing security risks.

Operators suspecting a compromise are advised to deploy a fresh server, as simply updating the software may not remove lingering access gained by an attacker. Additional recovery protocols include rotating all user wallet keys under Super Admin privileges, replacing funding-source credentials such as API keys and macaroons, resetting other stored settings secrets, and reviewing or re-establishing extension connections for services like NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA. The GitHub release notes highlight extensive security hardening across authentication, extension management, and payment processing, alongside various dependency updates.

Alongside critical patches, the new version introduces several features including on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a built-in job scheduler, automatic extension updates, and hold invoice support for the main funding source. Originally established in 2019 by Ben Arc before incorporating a commercial entity, the platform functions as a hot wallet. The project reminds operators to maintain only operational balances online, regularly audit activity, and store excess funds using offline keys. As of the v1.7.0 release announcement, the development team has not provided an aggregate total of funds lost across all impacted instances.

Why it matters

This urgent security update directly impacts self-hosted node operators, businesses, and individual users relying on the platform for Lightning Network transactions. Ensuring timely software updates and proper key rotation is critical for maintaining the safety of digital assets stored on hot wallet configurations.