LNbits Issues Emergency Update After 0.023 BTC Theft

By Elena Vasquez

What is confirmed?

LNbits said it had confirmed a case involving the withdrawal of 2.3 million satoshis (0.023 BTC) after attacks on its Bitcoin Lightning wallet platform, prompting an emergency release on Nov. 10. The project has not disclosed the aggregate value of the losses.

The disclosed case equals 2.3% of the 100 million satoshis in one bitcoin, and the disclosure provides no dollar valuation. One withdrawal cannot establish the scale of a series of attacks, particularly when affected operators have not been publicly counted.

LNbits lets users build wallets and payment services on the Bitcoin Lightning Network, with uses including online payments, tips and paid content. Developer Ben Arc wrote on X that “users and the team had suffered losses over the past few days” while working intensively to release version 1.7.0.

The statement confirms losses but does not identify victims, attack vectors or the number of affected deployments. LNbits also withheld the specific vulnerability, limiting independent assessment of which servers were exposed and whether its recommended containment steps were sufficient.

Takeaway: One 0.023 BTC withdrawal is confirmed, while the total loss remains unknown.

Why did operators shut down servers?

On Nov. 8, LNbits warned that a security issue may have been discovered in Paywall, a payment-related extension, and instructed users to disable it. About an hour later, as attacks continued, the project asked operators to “shut down their servers immediately” and temporarily closed its hosted service.

The public response moved from isolating one extension to suspending an entire operating environment. That escalation shows how quickly the operational scope expanded, although the warning did not explain whether Paywall itself contained the flaw or served as one route into the attacks.

Shutting down a server halts its wallet service and can interrupt an attack in progress, but it also disrupts the payment functions operators have built around LNbits. The disclosure does not quantify that service interruption or identify how many hosted customers were affected.

Takeaway: The response escalated from disabling Paywall to shutting down servers before the fix.

What does version 1.7.0 require?

The project released version 1.7.0 on Nov. 10, according to Cointelegraph’s same-day report. The software strengthens user authentication, extension management and payment processing to address the vulnerability, and LNbits said the flaw affected every version before 1.7.0.

LNbits instructed operators to install the emergency update immediately. The patch alone does not resolve the persistence problem: exposed credentials might still permit access after installation, so operators should replace wallet access keys and credentials tied to funding sources.

Any secrets stored in settings should be treated as compromised. Operators who believe a server may already have been breached should consider migrating to a new server environment, because updating code on the same machine does not by itself remove an intruder’s foothold.

Those instructions impose work beyond a routine upgrade: operators must replace access keys and funding credentials, then assess whether a server that may have been accessed by an intruder remains trustworthy. The disclosure provides no technical indicators for that assessment.

Takeaway: Updating code does not remove captured secrets or restore a potentially breached server.

How much was lost, and what is still unknown?

User Kevin Ravensberg said an attacker created a new account on his server and withdrew about 2.3 million satoshis, or 0.023 BTC. He said the funds drained before he shut down the server, and LNbits subsequently described the case as confirmed.

That account-creation detail comes from Ravensberg’s account, not a published forensic report. It points to unauthorized server access, but it does not establish that every affected operator suffered the same sequence or that the disclosed 0.023 BTC represented the first and last withdrawal.

LNbits has not disclosed the specific vulnerability used in the attacks or the total scale of losses. It plans to publish a separate report on how the attack unfolded and the findings of its security investigation, but the project has announced no publication date.

Without that report, the available disclosure does not support an estimate of affected operators, aggregate losses or whether credential replacement and server migration contained further withdrawals. The planned report is the next evidence needed, not a resolution already delivered.

Takeaway: The next verifiable checkpoint is LNbits’s promised incident report; without its findings, operators cannot size aggregate losses or dismiss remaining credential and server-compromise risk.