LNbits Ships Emergency Patch After Lightning Wallet Thefts Reported

LNbits, the open-source software behind an estimated 200,000 self-hosted Bitcoin Lightning wallets, has released an emergency patch after attackers exploited a vulnerability to withdraw funds from at least one user's server.

The project warned operators on Sunday to disable its Paywall extension while investigating a potential flaw. Just over an hour later, it escalated the guidance: shut down LNbits servers immediately, citing a wave of attacks. The project also took its own hosted installations offline as a precaution.

The emergency patch resolves a vulnerability the project says affects all LNbits versions before 1.7.0. Funds held in affected installations remain at risk of theft until operators upgrade.

What does the attack look like in practice?

One operator, Kevin Ravensberg, described the mechanics of the exploit firsthand. Attackers breached his LNbits instance and withdrew roughly 2.3 million satoshis — approximately 0.023 Bitcoin — through newly created accounts before he could take his server offline.

The pattern matters for practitioners. The withdrawal path ran through account creation, not a single privileged key, which suggests the flaw sat in the application layer that LNbits exposes to end users. Cointelegraph has reached out to developer Ben Arc and the LNbits team for further comment; neither has yet publicly detailed the exploit's root cause.

LNbits said a separate technical report on the vulnerability will follow.

What does the patch change for operators?

Upgrading to 1.7.0 closes the hole, but the project's accompanying announcement makes clear that a version bump alone is not sufficient remediation. Credentials exposed before the upgrade may still grant attackers access afterward.

The project's guidance for operators runs longer than the patch itself:

• Reset wallet keys after upgrading
• Replace all funding-source credentials
• Treat every secret stored in LNbits settings as compromised
• Migrate to a fresh server if any compromise is suspected

That last item carries real operational weight. A fresh server means re-provisioning the host, re-importing wallets under new credentials and re-verifying channel backups — hours of work for a merchant running LNbits behind a checkout, tipping service or paywall, the three use cases the software most commonly serves.

The scale of exposure is unusual for a Lightning-layer incident. Ben Arc said in May that roughly 200,000 people run LNbits themselves. Not every installation ran the vulnerable configuration, and not every vulnerable instance held meaningful balances, but the advisory effectively instructs every one of those operators to act.

What happens next?

Two open questions define the coming days. The first is the promised technical report, which will determine whether the flaw was specific to the Paywall extension or a broader issue in LNbits' account and key handling. The second is victim count: the project has not said how many operators lost funds before the patch shipped.

Operators still running pre-1.7.0 versions should treat the upgrade and full credential rotation as immediate, not scheduled, work.