LNbits Ships Urgent 1.7.0 Patch After Attacks Drain Self-Hosted Wallets

LNbits released version 1.7.0 on November 10, an urgent security update shipped two days after attackers drained funds from self-hosted Lightning Network instances while the project told every operator to power their servers down.

The release post is blunt about what's still exposed: "funds running on prior versions of LNbits are at risk of being stolen." Version 1.7.0 patches three areas — authentication, extension management and payment handling — and LNbits instructs operators to complete the upgrade before restarting any server. A full technical report on the exploit has not been published yet.

How did the attack unfold?

The trouble surfaced on November 8, when attackers created unauthorized accounts on LNbits instances and withdrew funds from them. LNbits posted on X that day telling all users to stop their servers immediately. The project said it had "a number of security patches to push" and that until they landed it was "better to err on the side of caution." LNbits also disabled instances running on its own hosted service while it worked on fixes.

One operator has put a number on his losses. Kevin Ravensberg, who runs the Telegram tipping service BitTipBot, said attackers created new accounts on his instance and withdrew 2,285,545 satoshis — roughly 0.0229 BTC — between approximately 09:22 and 14:00 UTC on November 8, before he managed to stop the server. He said on X that he will make all BitTipBot users whole himself, but users can't access funds until LNbits has patched the vulnerabilities. That is a personal pledge made on social media, not an audited guarantee. No aggregate loss figure across affected instances exists yet.

What does the patch change?

The fixes go beyond a version bump. LNbits says updating alone cannot strip out access an attacker may already have gained. For operators who suspect compromise, the project's recovery guidance calls for:

• Building a fresh server from scratch
• Rotating all user wallet keys as Super Admin
• Replacing funding-source credentials such as API keys and macaroons
• Re-creating connections for extensions including NWC Provider, LNDHub and Bolt Cards

The episode cuts against a common assumption among bitcoin users: that self-hosting your own software removes the third-party risk that has felled custodial services. LNbits itself frames its software as a hot wallet — an always-online configuration where even audits have failed to protect funds elsewhere in the industry. The project's standing advice is to keep only operational balances online, review account activity regularly and move excess funds to offline keys.

Drain incidents have forced drastic responses elsewhere this year. Qubic halted its mainnet after a seed exploit drained 1,404 wallets — a reminder that wallet-side compromises, not just exchange failures, can halt entire networks.

Who is behind LNbits?

Ben Arc founded LNbits in 2019 as a free and open-source project, and it now operates a commercial entity to fund development. The software is widely used to run accounts, extensions and tipping services on top of Lightning nodes, which is why the November 8 shutdown instruction rippled through the small-operator ecosystem within hours.

Operators still running pre-1.7.0 versions face a straightforward calculus: their funds are explicitly at risk of theft per the project's own advisory, and the full technical disclosure — which will detail exactly how the attackers got in — is still pending.