LNbits Releases 1.7.0 Urgent Security Update After November 8 Attacks Drain Funds

The project's official X account announced the release with a link to the GitHub repository, explicitly labeling it a "SECURITY UPDATE." This follows a weekend of attacks that began on November 8, when LNbits first instructed users to stop their servers immediately after detecting active exploits.

During the attacks, attackers created new accounts and withdrew funds from multiple instances. Kevin Ravensberg, operator of the Telegram tipping service BitTipBot, reported that attackers withdrew 2,285,545 satoshis (approximately 0.0229 BTC) from his instance between 09:22 and 14:00 UTC on November 8.

Security Measures

According to the official upgrade guidance, versions prior to 1.7.0 are affected, and "funds running on prior versions of LNbits are at risk of being stolen." The project stated that 1.7.0 includes security fixes in response to the incident discovered on November 8.

Operators are advised to set up fresh servers if compromise is suspected, as updating alone cannot remove access attackers may already have gained. Additional recovery steps include rotating all user wallet keys as Super Admin, replacing funding-source credentials, and reviewing connections for extensions.

New Features

The GitHub release notes describe extensive security hardening across authentication, extension management, and payment handling. Version 1.7.0 also introduces new features including on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, and hold invoice support.

Founded in 2019 by Ben Arc, LNbits provides multi-user accounts and a large suite of extensions on top of any Lightning funding source. As of the announcement, the project has not published an aggregate total of funds lost across all affected instances.