lnbits wallet thefts: Emergency 1.7.0 Release After Attacks Drain Lightning Servers

The lnbits wallet thefts forced an emergency release: LNbits, the open-source toolkit many people use to run their own Bitcoin Lightning wallets and payment apps, shipped version 1.7.0 on November 10 and told every operator to upgrade "immediately" after attackers stole funds from vulnerable servers. The project says every version before 1.7.0 is affected and that updating alone may not lock out an attacker who already got in.

What actually happened

LNbits powers Lightning wallets plus add-ons like merchant checkouts, tipping and paywalls. Creator Ben Arc said in May that about 200,000 people run it themselves, according to Cointelegraph.

On Sunday, November 8, the project told operators to disable its Paywall extension while it looked into a possible vulnerability. Just over an hour later it escalated, telling users to shut down their LNbits servers right away because of a wave of attacks, and took its own hosted installations offline.

On Tuesday, the team published v1.7.0 on GitHub at 17:09 UTC, headed "ALL LNBITS USERS SHOULD UPDATE IMMEDIATELY." The release notes describe it as a critical security release with hardening across authentication, extension management and payment handling. "It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," Ben Arc wrote on X, per Cointelegraph.

Kevin Ravensberg, the user who reported losing about 2.3 million sats, told Cointelegraph the money left through new accounts the attacker created on his instance before he managed to shut the server down. The project has not said how many instances were hit or how much was stolen in total.

What operators need to do

The official upgrade guide is blunt. The key steps:

• Prefer a fresh server if you suspect compromise, and install 1.7.0 there. Save logs before wiping the old box.
• As Super Admin, reset wallet keys for all users. Old keys stop working, so connected apps need the new ones.
• Revoke and replace funding-source credentials such as API keys and macaroons, then update them in LNbits.
• Rotate any other secrets in settings and recreate connections for extensions like NWC Provider, LNDHub, Bolt Cards, TPoS, Bleskomat and FOSSA.

LNbits also reminds users that it is a hot wallet. It recommends keeping only day-to-day funds online and sweeping the rest to an on-chain wallet with offline keys, noting that AI-driven attacks raise the risk for any internet-facing system.

Why the lnbits wallet thefts matter

Self-hosting is supposed to be the safe, sovereign option. But a self-hosted server is only as secure as the software and the person patching it. When thousands of independent operators run the same code, one bug becomes thousands of targets, and there is no central team that can freeze funds for everyone.

The release also bundles big new features, including TOTP two-factor login, on-chain wallets, BOLT12 offers and NIP-17 support. That is good news long term, but a large upgrade during an active incident means more things to test. Operators should follow the recovery checklist first and explore new features later.

Front-end and infrastructure attacks are having a week. A domain hijack hit a major bridge on Tuesday, echoing the polymarket debugbear drain. Hardware is not immune either, as our trezor safe 5 implant story showed.

What to do as a reader

If you run LNbits, upgrade to 1.7.0 from the GitHub release page and then do the full key and credential rotation. If you use a wallet someone else hosts on LNbits, ask the operator whether they upgraded and rotated keys, and move funds you do not need right now.

Do not trust DMs offering "patches" or recovery help, and get updates only from official LNbits channels. The lnbits wallet thefts are a reminder to keep hot wallets small. Nothing here is investment advice.