LNbits 1.7.0 Patches Flaw; Exposed Keys Need Replacement

About 0.023 BTC was stolen after an attacker created a new account through a user's LNbits instance, according to LNbits. The Bitcoin Lightning wallet project responded by releasing version 1.7.0 and urging operators to update, while warning that installing the software alone cannot protect exposed credentials.

LNbits said the vulnerability affects every version before 1.7.0. Its response covers three risks that require different remedies: vulnerable software, exposed wallet credentials and a potentially breached server.

In its advisory, LNbits said: "Installing the release will not secure a wallet if its credentials have already been exposed." That statement limits what the release can accomplish after a credential leak, even when an operator completes the update.

What changed in version 1.7.0?

Version 1.7.0 addresses the flaw identified in earlier LNbits releases. The project urged every operator running a version before 1.7.0 to install the update, making software remediation the first step in its response to the reported theft.

Installing the update addresses the vulnerable software, not the consequences of exposed credentials. LNbits advised affected operators to reset wallet keys and replace related credentials after installing the release. Operators should complete those steps even if the patch closes the vulnerability, because the advisory treats leaked access information as a separate risk.

What should operators do after updating?

LNbits instructed operators who suspect a server intrusion to migrate the service to a new server. Migration addresses a host that may have been compromised; it does not replace the need to replace wallet keys and related credentials. The project divided its recommendations across three actions:

• Update the LNbits instance to version 1.7.0 to address the vulnerability affecting all earlier versions.
• Reset wallet keys and replace related credentials where access information may have leaked.
• Move the service to a new server if the operator suspects a host compromise.

The order matters. A current software version cannot protect a wallet whose credentials have already been exposed. Operators should therefore treat updating and credential replacement as separate tasks, rather than the release as complete remediation for the incident.

What does the reported theft establish?

One user reported that an attacker created a new account through the user's LNbits instance and stole about 0.023 BTC. The disclosed figure covers one user's reported loss, rather than an aggregate tally for every affected operator.

LNbits founder Ben Arc said users and the team had suffered losses and were working to address the incident. His account places the 0.023 BTC theft within wider losses, without quantifying them.

Operators should treat 0.023 BTC as the size of the one reported theft, not as a complete measure of the incident's impact. The project has not specified how many wallets were affected.

What remains unresolved after the update?

Version 1.7.0 addresses the affected code, but the project still advises credential resets when access information may have leaked. LNbits reserved server migration for suspected host compromises rather than recommending a new host for every instance.

The practical distinction is between changing the application and changing who can access the wallet. An update addresses the software vulnerability; replacing keys and credentials addresses access information that may already be exposed.

No fixed calendar deadline appears in the guidance. The remediation window stays open until operators update, replace exposed access information and, where warranted, move the service to a new server.