LNbits, the popular open-source Lightning wallet and accounts layer, has pushed out an urgent v1.7.0 release after a wave of attacks that began on Saturday, November 8 left several self-hosted instances drained of funds. The project is warning that every version before 1.7.0 is vulnerable and that funds held on older releases are at risk of being stolen.
What Happened
The trouble surfaced over the weekend, when the LNbits team posted on X telling all users to shut down their LNbits servers immediately. The team said it was seeing active attacks, that security patches were being prepared, and that it was "better to err on the side of caution." Instances on the project's own hosted service were switched off at the same time.
Several operators then reported attackers creating new accounts on their servers without permission and withdrawing funds. One of the clearest public accounts came from Kevin Ravensberg, who runs the Telegram tipping service BitTipBot. He said attackers set up fresh accounts on his instance and pulled out 2,285,545 sats (about 0.0229 BTC) over a window of roughly 09:22 to 14:00 UTC on November 8.
LNbits has not yet released a total figure for losses across all affected instances, and the exact exploit has not been disclosed. The project says a full technical write-up will follow once operators have had a chance to patch.
Why LNbits Matters
Started by developer Ben Arc in 2019, LNbits sits on top of a Lightning node, such as LND or Core Lightning, and turns it into a multi-user wallet system with a large library of plug-in extensions. Those extensions cover everything from point-of-sale terminals to tipping bots, Bolt Cards and Nostr Wallet Connect. It has often been described as "the WordPress for your Lightning node," and it is widely used by hobbyists, merchants and service operators, either self-hosted or through managed hosting.
That flexibility is also why the incident is serious. An LNbits server is a hot wallet: it holds credentials that can spend directly from the Lightning node underneath it. If an attacker gets in, they can move whatever balance that node is willing to pay out.
The Fix: LNbits v1.7.0
According to the GitHub release notes, v1.7.0 brings broad security hardening across authentication, extension management and payment handling, along with updated dependencies. The release also bundles a batch of new features that were already in the pipeline, including:
- On-chain wallet support
- Paying BOLT12 offers
- TOTP two-factor authentication
- NIP-17 support
- A built-in job scheduler and automatic extension updates
- Hold invoice support when LNbits itself is used as the funding source
Upgrading Isn't Enough on Its Own
The most important part of the guidance is that simply installing the update may not be enough. If an operator suspects their server was compromised, LNbits recommends building a fresh server, because an attacker who already got in may have left behind access that an upgrade won't remove.
The project's recovery checklist also tells operators to:
- Rotate every user wallet key from the Super Admin account
- Replace funding-source credentials, such as API keys or LND macaroons
- Rotate any other secrets stored in LNbits settings
- Review or re-create connections for extensions such as NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA
The Bigger Lesson for Lightning Operators
The incident is another reminder that Lightning tooling, however convenient, is internet-facing software holding live funds. LNbits itself advises operators to keep only working balances on the server, review activity regularly, and sweep anything extra to offline keys. It lands only weeks after other Lightning security scares, including emergency LND releases tied to a Linux kernel flaw, and shows that the riskiest part of Lightning is often the software wrapped around the node, not the protocol itself.
Anyone running LNbits who has not yet upgraded should read the official upgrade guidance before bringing their server back online.
12 November 2026
Country:
Global
Topic:
Security | Scaling