LNbits 1.7.0 Addresses Security Incident After November 8 Attacks

Urgent release follows reported attacks

LNbits released version 1.7.0 on November 10, describing it as an urgent security update and telling operators to upgrade before restarting their servers. The release followed active attacks reported by the project on November 8. The sequence matters for operators because the warning was not simply to install a routine software update: LNbits had already told users to stop their servers while it prepared patches, and the new guidance says older versions remain exposed.

The project’s November 8 notice urged all users to stop LNbits servers immediately and said it was safer to err on the side of caution. It also disabled instances on its hosted service. The action indicates that the response covered both self-hosted operators and the project’s own hosted environment, although the source does not describe how many instances were affected or provide a complete account of the disruption.

Reports described unauthorized account creation followed by withdrawals from LNbits instances. Kevin Ravensberg, who operates the Telegram tipping service BitTipBot, said attackers opened new accounts on his instance and withdrew 2,285,545 satoshis, approximately 0.0229 BTC. He placed the activity between about 09:22 and 14:00 UTC on November 8. This is a documented instance, not a published total for losses across the LNbits ecosystem.

Upgrade guidance extends beyond installing the patch

LNbits’ upgrade guidance identifies versions before 1.7.0 as affected and warns that funds on those versions are at risk of theft. The practical instruction is to install the release before bringing a server back online, rather than treating the earlier shutdown notice as the end of the response. The project says the version contains security fixes for the incident discovered on November 8, but has not yet released its full technical account of the exploit.

Operators who suspect an instance was compromised are advised to set up a fresh server. LNbits explicitly cautions that an update alone cannot remove access an attacker may already have obtained. That distinction is important: patching addresses the vulnerable software, while rebuilding is presented as a way to respond to possible persistent access. The guidance does not establish that every operator needs a fresh server; it makes that step conditional on suspected compromise.

The recovery checklist also calls for rotating all user wallet keys as Super Admin, replacing funding-source credentials such as API keys or macaroons, and changing other secrets stored in settings. Those steps reflect the range of information an attacker might be able to use after gaining access. Operators are asked to review or recreate connections for extensions as well, so recovery is not limited to the core LNbits application or to the credentials used to fund it.

Security hardening arrives with new features

Among the named extensions and connections are NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA. Their inclusion makes the operational scope of the response broader than a single password reset: operators need to assess integrations linked to their instances and determine whether credentials or connections should be replaced. The source provides this list as part of the recovery guidance, but does not say that each named extension was itself the cause of the attacks.

The project describes LNbits as a hot wallet and advises operators to keep only operational balances online, review activity regularly and move excess funds to offline keys. Those precautions are particularly relevant while the incident’s technical details and full loss figures remain unpublished. They do not substitute for installing the security update or following recovery steps where compromise is suspected; they describe how operators can limit the amount held online and monitor activity.

The GitHub release notes characterize 1.7.0 as extensive security hardening across authentication, extension management and payment handling, alongside dependency updates. These categories show that the release reaches several parts of the software rather than announcing only a single visible change. Without the promised full technical report, however, the source does not identify the precise flaw or explain which of those areas was exploited in the November 8 incident.

Exposure and total losses remain unclear

Version 1.7.0 also brings features beyond the security response: on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support and a job scheduler. The release additionally includes automatic extension updates and hold invoice support for the LNbits funding source. Their arrival in the same version broadens its functionality, but the project’s central instruction remains security-focused: operators should upgrade before restarting their servers.

LNbits began in 2019 as a free, open-source project founded by Ben Arc and later incorporated a commercial entity to support development. It provides multi-user accounts and a large suite of extensions on top of Lightning funding sources, including LND and Core Lightning. Its software is used through both self-hosted and managed instances, so the November 8 warning concerns an ecosystem with different operating arrangements rather than one deployment model alone.

A September 2024 Bitcoin Magazine profile described LNbits as the WordPress for a Bitcoin Lightning node and noted its use by individuals, businesses and node operators seeking accessible Lightning tools. The incident’s aggregate financial impact remains unknown: LNbits has not published a total for funds lost across affected instances, and its full technical report is still pending. Until those details are available, operators are directed to the official guidance before returning servers to service.

Source: BitcoinMagazine