LNbits Ships Urgent 1.7.0 Security Update, Tells Operators to Upgrade Before Restarting Servers

Published November 11, 2026, 6:15 AM PKT. Based on LNbits' official upgrade guidance published November 10, 2026 (primary source), and reporting by Bitcoin Magazine on November 10, 2026 (secondary source).

LNbits released version 1.7.0 on November 10, 2026 as an urgent security update, and told every operator to upgrade before running the software again. The release follows the wave of attacks that began on November 8, when the open-source Lightning Network wallet and accounts platform ordered all server operators to shut down immediately after attackers created unauthorized accounts and withdrew funds.

The instruction is blunt. LNbits said in its official upgrade guidance that all operators must upgrade to 1.7.0 before running LNbits, that versions prior to 1.7.0 are affected, and that funds running on prior versions are at risk of being stolen. The project's official X account posted the announcement with a link to the GitHub release, calling it a "SECURITY UPDATE", according to Bitcoin Magazine, which reported the release at 4:32 p.m. ET on November 10.

The release ends two days of forced downtime for the platform's operators, but it does not end the incident. LNbits said a full technical report on the exploit will follow, and as of the announcement it had not published an aggregate total of funds lost across all affected instances. The only confirmed loss so far remains the one documented case from November 8.

The November 8 attacks

The attacks began over the weekend of November 8. LNbits first flagged a potential vulnerability in its Paywall extension at about 12:33 UTC that Sunday and advised operators to disable it. About 80 minutes later, at about 13:56 UTC, the project escalated to a systemwide shutdown order, telling all users to stop their LNbits servers immediately and adding that security patches were being prepared.

Multiple reports documented unauthorized account creation and fund withdrawals. The clearest confirmed loss came from Kevin Ravensberg, operator of the Telegram tipping service BitTipBot, who said attackers created new accounts on his instance and withdrew 2,285,545 satoshis, about 0.0229 Bitcoin ($BTC), between roughly 09:22 and 14:00 UTC on November 8. Ravensberg pledged to reimburse affected BitTipBot users personally, though access to funds stayed frozen while the fix was prepared.

The project also disabled instances on its hosted service, my.lnbits.com, which stayed suspended while the patch was built. LNbits co-founder Ben Arc estimated at the time that security patches would be available within 24 to 48 hours. Version 1.7.0 arrived inside that window, about 56 hours after the shutdown order.

What exactly was exploited is still not public. The precise flaw has not been disclosed, and it is not established whether it sits in LNbits' core account-management layer or in a specific extension, though the Paywall extension was the first thing flagged. The incident is an LNbits software failure, not a break in Bitcoin ($BTC) or the Lightning Network protocol itself. LNbits is an account and application layer that sits on top of Lightning funding sources such as LND and Core Lightning.

Upgrade first, then recover

Upgrading to 1.7.0 is only the first step, according to the official guidance. LNbits warned that credentials exposed before the upgrade may still give an attacker access afterwards, so operators must take five recovery steps alongside the update.

First, prefer a fresh server. If a compromise is suspected, operators should install LNbits on a new server and put 1.7.0 on it, because updating alone cannot remove access an attacker may already have gained. Relevant logs and records should be preserved before the old server is replaced.

Second, rotate all user wallet keys. Logged in as Super Admin, operators open Settings, then Users, select Reset Wallet Keys and confirm. Existing keys stop working, so users must update any connected apps and integrations with their new keys.

Third, replace funding-source credentials. Operators must revoke and replace credentials at the funding source, rotating API keys or macaroons depending on the setup, then update the funding-source settings in LNbits. Fourth, rotate any other sensitive credentials stored in settings, treating them all as compromised.

Fifth, review connected apps and integrations. Operators should revoke or delete existing extension connections and create new ones with the updated credentials. The extensions with connections that need this treatment are NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA.

What 1.7.0 changes

The release notes describe extensive security hardening across authentication, extension management and payment handling, plus dependency updates, according to Bitcoin Magazine. The fixes respond directly to the incident discovered on November 8, and the project said the full technical report will follow in a separate publication.

Version 1.7.0 also ships new features alongside the security work: on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates, and hold invoice support for the LNbits funding source.

The project used the release to restate how operators should treat live funds. LNbits is a hot wallet, the guidance said, and hot wallets carry risk because the credentials needed to spend funds are available to an online system. With the increase in AI-driven attacks, the guidance said, the risk of compromise is higher than ever, and operators should always assume any online system can be compromised.

The practical rule LNbits gave is to keep only the funds needed for day-to-day operations online, regularly review balances and outgoing payments, and send excess funds to an on-chain wallet whose spending keys are kept offline.

What is still unknown

Three things remain unanswered. The first is the exploit itself: the root cause, and whether it was a single flaw or several, will only be known when the full technical report lands. The second is the total loss. The 2,285,545 satoshis documented by Ravensberg is one operator's self-reported figure for his instance, and no official aggregate across all affected instances has been published.

The third is the hosted service. LNbits disabled its hosted instances on November 8 and the guidance does not give a date for their return, so operators on my.lnbits.com have no restart timeline yet even though the patch is out.

Until the report arrives, the picture is a patch that is live, an upgrade order that is absolute, and a recovery checklist that treats every credential on a pre-1.7.0 server as exposed. Operators who restart without upgrading, or upgrade without rotating keys, are still running the risk the shutdown was meant to stop.

Sources

• LNbits, LNbits 1.7.0: security update and upgrade guidance, published November 10, 2026 (primary source: all operators must upgrade to LNbits 1.7.0 before running LNbits; versions prior to 1.7.0 are affected and funds on prior versions are at risk of being stolen; version 1.7.0 includes security fixes in response to the incident discovered on November 8; credentials exposed before the upgrade may still give an attacker access afterwards; full details of the exploit to follow in a separate report; recovery steps are a fresh server, rotating all user wallet keys as Super Admin, replacing funding-source credentials, rotating other secrets, and reviewing extension connections for NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA; LNbits is a hot wallet and operators should keep only day-to-day funds online and send excess to an on-chain wallet with offline keys)
• Bitcoin Magazine, LNbits Releases 1.7.0 Urgent Security Update After November 8 Attacks Drain Funds, published November 10, 2026 (secondary source: official X account posted the announcement with a link to the GitHub release, calling it a SECURITY UPDATE; November 8 shutdown order at about 13:56 UTC after active attacks, with Paywall flagged at about 12:33 UTC; hosted service instances disabled; Kevin Ravensberg reported 2,285,545 satoshis, about 0.0229 BTC, withdrawn between about 09:22 and 14:00 UTC on November 8; extensive security hardening across authentication, extension management and payment handling plus dependency updates; new features include on-chain wallet support, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a job scheduler, automatic extension updates and hold invoice support; no aggregate total of funds lost published as of the announcement)
• TFTC, LNbits Emergency Shutdown: Active Attacks Drain Funds, published November 8, 2026 (secondary source: shutdown directive at about 13:56 UTC on November 8 after a wave of attacks exploiting account-creation and withdrawal functions; Ben Arc expected security patches within 24 to 48 hours; LNbits had pushed a v1.6.0 security release in September 2026 following an audit by V12)

This article is news reporting and is not investment advice.