Image Credit: Coin Insider
- LNbits released version 1.7.0 as an emergency security update after reports of stolen funds from Lightning wallets.
- Installing the patch alone may not help, as credentials exposed before the upgrade can still give attackers access.
- Operators must reset wallet keys, replace funding credentials, and use a fresh server if they suspect a compromise.
LNbits, software for running Bitcoin Lightning wallets and payment services, has released an emergency security update after reports of stolen funds. Its developers warn that all versions before 1.7.0 are affected.
The patch is now available, but operators still need to replace credentials that attackers may already possess.
Version 1.7.0 Is Required Before Servers Run Again
The security release was published on Nov. 10 at 17:09 UTC. It follows the Nov. 8 warning that prompted operators to shut down their LNbits servers while the team investigated wallet thefts.
That earlier alert left operators waiting for a verified fix. Version 1.6.2, the previous published release, was a September database-backup hotfix rather than an update addressing this incident.
Operator Kevin Ravensberg previously reported an unauthorized withdrawal of 2,285,545 satoshis, about 0.0229 BTC. He also said BitTipBot users could not access their funds until the vulnerabilities were patched and pledged to reimburse them.
Version 1.7.0 includes fixes across authentication, extension management and payment handling, alongside support for time-based, one-time passwords for two-factor authentication. Its release notice carries an unusually blunt instruction:
“ALL LNBITS USERS SHOULD UPDATE IMMEDIATELY”
LNbits supports services such as merchant checkouts, tipping tools and paywalls built around Bitcoin Lightning payments. The update also adds a tool allowing superusers to reset all wallet keys.
Old Wallet Keys and Funding Credentials Must Be Replaced
The recovery advisory explains why installing the patch alone may fall short:
“Credentials exposed before the upgrade may still give an attacker access afterwards.”
Super Admins should select Settings → Users → Reset Wallet Keys. This invalidates existing keys, requiring users to update connected apps.
Operators must revoke and replace funding-source credentials, such as API keys or macaroons, at the source, then update LNbits settings. Other stored secrets and extension connections also need replacing.
Suspected Compromises Call for a Fresh Server
Where a compromise is suspected, LNbits recommends installing 1.7.0 on a new server. Operators should preserve relevant logs and records before replacing the old installation.
A full security report explaining the exploit is still pending, and the advisory gives no combined loss figure or affected-installation count.
For ongoing operations, the team recommends keeping only day-to-day funds online, reviewing outgoing payments and moving surplus funds to an on-chain wallet whose spending keys stay offline.
