LNbits Ships Emergency Patch After Bitcoin Lightning Wallet Thefts

Bitcoin Lightning infrastructure project LNbits shipped a critical security release on Tuesday, warning that attackers had already stolen funds from self-hosted wallet installations running software versions older than 1.7.0. The patch addresses vulnerabilities and hardens authentication, extension management and payment handling, but the project cautioned that updating alone would not protect installations whose credentials had already been compromised.

The response moved fast. On Sunday, LNbits first told operators to disable its Paywall extension while it investigated a potential vulnerability. A little over an hour later, the project escalated: shut down your LNbits servers immediately, it said, citing a wave of live attacks. It also took its own hosted installations offline.

"It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," LNbits creator Ben Arc wrote on X.

What does this change for operators?

Plenty, if you run a node. LNbits provides software for running Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls. Arc said in May that roughly 200,000 people run the software themselves. That's a large surface of self-hosted instances, and the project says every version before 1.7.0 is vulnerable and puts funds at risk of theft.

The harder message sits in the fine print. Credentials exposed before upgrading could still give attackers access afterward. LNbits urged operators to:

• Reset wallet keys
• Replace funding-source credentials
• Treat every secret stored in LNbits settings as compromised
• Move to a fresh server if a compromise is suspected

One user has already quantified his loss. Kevin Ravensberg said attackers exploited his LNbits instance and withdrew roughly 2.3 million satoshis — about 0.023 Bitcoin — through newly created accounts before he could shut down the server. The pattern suggests attackers could register accounts on exposed instances and drain funds through them.

What is still unknown?

A lot. LNbits has not detailed the exploit itself or said how many installations were hit. The company said a separate technical report on the vulnerability would follow, which is when the community will learn whether the flaw sat in the Paywall extension alone or ran deeper into the platform's core payment handling.

The incident lands at an awkward moment for Lightning infrastructure. Self-hosted wallet software spreads operational risk across thousands of operators who rarely have security teams, so a single vulnerability in a widely deployed version can produce simultaneous, geographically scattered thefts before maintainers can even characterize the bug.

For merchants running LNbits-backed checkouts, the practical calculus is stark. Keep the server down, rotate everything, and treat the machine itself as suspect. The 2.3 million satoshis pulled from Ravensberg's instance show the attack path was automated enough to move before a human could react — roughly an hour passed between LNbits' first Paywall warning and its full shutdown order.

Cointelegraph reported that it reached out to Arc and LNbits for additional comment.

The next checkpoint is the promised post-mortem. Until that report lands and operators confirm they've rotated keys and funding credentials on clean servers, every pre-1.7.0 instance still running should be treated as exposed.