LNbits has told operators to update immediately to version 1.7.0 after reporting a wave of attacks on LNbits instances that led to stolen funds. The project described the release as a critical patch for vulnerabilities and said all versions before 1.7.0 are affected.

The warning goes beyond a standard software update. LNbits said upgrading alone may not be enough for systems where credentials were already exposed, and urged operators to replace sensitive keys and credentials and consider rebuilding on a fresh server if they suspect a compromise.

Emergency response after reports of theft

The project said it rushed out v1.7.0 after several difficult days responding to incidents that affected both users and the team itself. LNbits creator Ben Arc wrote on X that the group had been working relentlessly to deliver the release after suffering losses during the attack wave.

According to LNbits, the latest version is intended to address the vulnerabilities while also reinforcing authentication, extension management and payment handling. The organization said the issue put funds at risk of theft on any installation running a version earlier than 1.7.0.

How the incident unfolded

LNbits first alerted operators on Sunday, initially telling them to disable its Paywall extension while it investigated a possible vulnerability. A little more than an hour later, the guidance escalated sharply: users were urged to shut down their LNbits servers immediately because of an active wave of attacks.

The project also took its own hosted LNbits installations offline during the response. That step underscored the seriousness of the incident, even as the team withheld technical details about the exploit itself.

Scope remains unclear

LNbits has not yet explained how the exploit worked, nor has it disclosed how many users or instances were affected. The available information so far is limited to the warning that funds were stolen and that pre-1.7.0 versions are vulnerable.

That leaves several open questions, including whether the attacks relied on a single flaw or a chain of weaknesses. For now, the confirmed facts are the existence of the attack wave, the release of an emergency patch and the project’s warning that exposed credentials can remain dangerous even after software is updated.

Why updating may not be enough

In its announcement for v1.7.0, LNbits stressed that operators should not assume a patch fully resolves the situation if attackers already obtained secrets from a system. The project said wallet keys should be reset, funding-source credentials should be replaced and any secrets stored in LNbits settings should be treated as compromised.

For installations that may already have been breached, LNbits recommended moving to a fresh server. That advice suggests the project is concerned not only about the original vulnerability but also about persistent access through credentials or configuration data exposed before the upgrade.

What LNbits is and the next confirmed step

LNbits provides software used to run Bitcoin Lightning wallets and related payment tools such as merchant checkouts, tipping services and paywalls. Ben Arc said in May that roughly 200,000 people self-host the software, making the incident notable for operators who manage their own instances.

The immediate confirmed next step from the project is clear: update to version 1.7.0 and rotate credentials where exposure is possible. Beyond that, LNbits has not yet published a fuller technical breakdown or an impact count, so operators are still waiting for more detail on how the attacks were carried out and how broadly they spread.

Source: cointelegraph.com