LNbits Update Leaves Pre-Update Credentials Potentially Usable

By Nathan Brooks

LNbits released version 1.7.0 on Tuesday to address a flaw affecting all earlier releases of its Bitcoin (BTC) Lightning wallet software, after project creator Ben Arc said the project and its users suffered losses in attacks.

Arc said it had been “a very challenging few days,” referring to the work required to release the emergency security update after the project and its users suffered losses. The project urged operators to install version 1.7.0 and warned that attackers could steal funds managed by installations still running earlier versions.

The initial disclosure did not quantify the losses, identify the attackers or provide a victim count, so it does not support a per-wallet or per-operator comparison. LNbits said a separate account of the exploit would follow but gave no publication date, leaving the attack’s financial reach unquantified.

That reporting gap does not change the immediate containment instructions. The Tuesday release addresses the flaw and also strengthens authentication, extension management and payment handling. LNbits software lets operators host Lightning wallets and payment applications for merchant checkout, tipping and paywall services.

The sequence before the release shows how the project escalated its response. On Sunday, before the Tuesday release, LNbits told operators to disable its Paywall extension while it investigated a potential vulnerability. After citing a wave of attacks, it urged operators to shut down their servers and took its hosted installations offline.

For operators, the shutdown instruction carried an immediate availability cost: those following it suspended wallet and payment services while they assessed exposure. LNbits also removed its hosted installations from service. Its disclosure gave no restoration schedule for those hosted installations.

What does the update change for operators?

Version 1.7.0 changes the software, but it does not automatically neutralize an exposure that occurred before installation. A server running the patched release can still expose funds if its wallet keys, funding-source credentials or secrets saved in settings remain usable.

The project therefore directed operators to:

• install version 1.7.0 as an emergency security update;
• reset wallet keys and replace funding-source credentials;
• treat secrets saved in settings as compromised; and
• move to a fresh server if they suspect the current server may have been compromised.

This guidance sets a higher operational bar than a routine version upgrade. Rotation replaces the credentials that an earlier exposure could have disclosed, while a fresh server avoids retaining a suspect environment that the patch alone cannot make safe. Neither step substitutes for the other, and both sit outside the scope of a normal software refresh.

For a merchant using LNbits for checkout, tipping or paywall services, the decisive issue is whether the operator environment can still control funds and service access after recovery, not merely whether its version number has changed. The project’s instructions make credential reset and, where relevant, server replacement prerequisites for treating that environment as restored.

The loss total remains unquantified, and the initial disclosure provided neither a technical account of the exploit nor an attacker identification; the next checkpoint is LNbits’s promised exploit account, for which no publication date has been set, so credential rotation and replacement of suspect servers remain the practical remediation path until more detail arrives.