LNbits Ships Second Patch in Three Days After Lightning Wallet Flaw

LNbits released version 1.7.1 on Nov. 11, a follow-up security patch that rotates authentication keys on installations of its Bitcoin Lightning wallet software, three days after a disclosed vulnerability put funds on older deployments at risk. The project urged all users to update but did not say which keys the rotation covers or whether it replaces earlier credential-reset guidance issued with the previous release.

The new patch lands one day after version 1.7.0 shipped on Nov. 10. That release closed a vulnerability discovered on Nov. 8 that affected every LNbits version released before 1.7.0 and put funds held on those installations at risk. Operators had to complete the upgrade before restarting the software at all — a hard stop, not a recommendation.

What changed between 1.7.0 and 1.7.1?

Version 1.7.1 rotates authentication keys, a step beyond the code fix in 1.7.0. The release notes link back to the earlier recovery guidance but stop short of explaining the rotation's scope. Two questions remain open:

• Which authentication keys are rotated by the patch.
• Whether the rotation supersedes the manual recovery steps or complements them.

That gap matters operationally. Credentials exposed before an operator upgraded may still grant an attacker access to an installation afterward, which is why the project's recovery instructions go well beyond a software update.

What do operators need to do?

The recovery steps published alongside 1.7.0 require manual work that no patch automates. Operators must change wallet keys and funding-source credentials, replace other secrets stored on the server, and rebuild certain extension connections. Anyone who suspects an actual compromise should not attempt in-place cleanup at all — the guidance is to move to a fresh server entirely.

The reasoning is structural. LNbits runs on top of a Bitcoin Lightning funding source and gives operators a management layer for wallets and connected services. Because spending credentials sit with an online service, LNbits is a hot-wallet system by design, and the project's standing advice is to keep only day-to-day operating funds online rather than meaningful reserves.

Were funds actually lost?

Yes, though the size is unknown. LNbits creator Ben Arc said the team and users suffered losses in connection with the vulnerability but gave no amount. The project has also not detailed how the flaw was exploited in practice. A separate post-incident report is planned, which would be the first public accounting of both the attack path and the damage.

For operators, the practical deadline is immediate: anyone still running a version earlier than 1.7.1 is running software with a known, actively discussed vulnerability and exposed authentication keys. The market-structure consequence is harder to read until the promised report lands — until LNbits publishes it, operators weighing Lightning infrastructure tooling are working from an incomplete picture of how a hot-wallet management layer failed and what it cost.