Mentioned in This Article
1. LNbits wallet operators told to upgrade at once
LNbits, an open-source platform for running Bitcoin (BTC) Lightning wallets, released version 1.7.0 on Tuesday, November 10, 2026, and told every operator to install it immediately after attacks on LNbits wallet servers led to stolen funds. The project said all earlier versions are vulnerable and warned that upgrading does not protect installations whose credentials were already exposed.
The project labeled the update a critical security release. It said the new version fixes vulnerabilities and tightens three areas of the software: how users are authenticated, how extensions are managed and how payments are handled. The release followed two days in which operators had been told first to switch off one component and then to shut their servers down entirely.
LNbits has not yet published a technical account of the flaw, and it has not said how many installations were hit. What it has said is unambiguous on the main point: anyone running a version older than 1.7.0 is exposed, and the money held on those servers is at risk of theft.
2. How the incident unfolded
Trouble first surfaced publicly on Sunday, November 8. That day, LNbits advised operators to disable its Paywall extension, an add-on that lets a site charge Lightning payments for access to content, while the team looked into a possible vulnerability. At that stage the guidance was limited to one optional feature.
The warning escalated quickly. A little more than an hour later, the project told users to stop their servers immediately and cited a wave of attacks. The shift from disabling a single extension to halting the entire application indicated that the team no longer regarded the problem as confined to one component.
LNbits also acted on its own infrastructure. The project took the installations it hosts on behalf of users offline, removing them from reach while a fix was prepared. For self-hosted operators, the instruction to shut down meant that merchant checkouts, tipping tools and other services built on the software stopped working until a patched version was available.
Two days passed between the shutdown call and the release of version 1.7.0. During that window, the safest state for any installation was to be switched off, since a server that is not running cannot be instructed to send funds.
3. What does LNbits 1.7.0 change?
Version 1.7.0 fixes the vulnerabilities behind the attacks and adds protections to authentication, extension management and payment handling. LNbits described the release as critical and told all users to move to it before running the software again.
Each of those three areas is a place where a wallet server can be abused. Authentication determines who is allowed to act on an account. Extension management governs the add-ons that give LNbits much of its functionality, each of which is additional code with access to the system. Payment handling covers the logic that decides when funds may leave a wallet. Hardening all three at once suggests a broad review rather than a single narrow correction.
The project has been clear about the scope of the exposure. Its patch announcement states that the vulnerability affects every version before 1.7.0 and puts funds at risk of theft. There is no older release that operators can fall back on as a safe option, which is why the guidance is to upgrade rather than to wait.
What the announcement does not contain is a description of the exploit itself. Withholding those details for a short period is common practice after a security incident, because publishing the mechanics before most users have upgraded would give attackers a guide to the servers that remain unpatched.
4. Why upgrading is not enough on its own
Patching closes the hole in the software, but it does nothing about secrets an attacker may already have copied. LNbits stressed this point directly: credentials exposed before the upgrade could still allow an intruder back in afterward. An installation can therefore be fully up to date and still be compromised.
For that reason, the project attached a list of follow-up steps to the release. Operators were told to reset wallet keys, which are the credentials that applications use to read balances and send payments from individual wallets. Resetting them invalidates the old keys, so any copy held by an attacker stops working.
Operators were also told to replace the credentials for their funding source. In LNbits, the funding source is the Lightning node or service that actually holds the bitcoin behind all the wallets on a server. Access to it is the most sensitive secret in the system, because whoever controls it controls the underlying funds.
Beyond those two items, LNbits said any secret stored in the software's settings should be treated as compromised and changed. Where an operator has reason to believe their installation was breached, the advice goes further still: move to a fresh server rather than continue on the old one. A machine that an attacker has accessed may have been altered in ways that an application upgrade will not undo.
5. One operator's account of the theft
A concrete picture of the attack comes from Kevin Ravensberg, an LNbits user who said his installation was exploited. According to his account, attackers created new accounts on his server and used them to withdraw about 2.3 million satoshis, or roughly 0.023 BTC, before he was able to shut the server down.
A satoshi is the smallest unit of bitcoin, equal to one hundred-millionth of a coin, and Lightning balances are usually quoted in satoshis because the network is built for small, fast payments. The sum taken from Ravensberg's server is modest by the standards of crypto thefts, but it illustrates the method: the intruders did not need to take over an existing user's wallet. They were able to set up accounts of their own and move money out through them.
The detail about newly created accounts is significant for other operators reviewing their own systems. A server that shows unfamiliar accounts or wallets, or outgoing payments that no legitimate user initiated, has the same signature as the case Ravensberg described. Checking for those signs is a reasonable first step for anyone trying to work out whether their installation was touched before it was taken offline, and it bears directly on whether the stronger remedy of a fresh server is warranted.
His experience also shows why speed mattered. The withdrawals stopped only when the server was taken offline, which is the same remedy LNbits prescribed for everyone on Sunday. Operators who acted on the shutdown instruction promptly limited the time in which the same technique could be used against them.
6. What is LNbits?
LNbits is software for running Lightning wallets and the payment applications built on top of them. The Lightning Network is a payment layer that sits above the Bitcoin blockchain and allows near-instant transfers at low cost, which makes it suited to everyday purchases and very small payments.
The platform lets a single operator create many separate wallets backed by one source of funds, and it adds functionality through extensions. People use it to run merchant checkouts, tipping services and paywalls, among other things. Many of them host the software themselves, on their own servers, which gives them control but also makes them responsible for keeping it updated and secure.
That design explains why a flaw in LNbits has direct financial consequences. A Lightning wallet server has to stay online and has to be able to sign payments automatically, so the means of spending the funds are present on an internet-connected machine. Software in that position is an attractive target, and a weakness in how it checks permissions can translate quickly into lost money, as the reports of the past few days show.
The self-hosted model also shapes how a fix reaches users. There is no central switch that updates every installation at once. Each operator has to learn about the release, apply it and carry out the credential changes on their own server. The project can patch and restore the installations it hosts itself, but for everyone else the protection provided by version 1.7.0 depends on individual operators acting on the warning. That is why the project's messages over the three days were phrased as direct instructions to operators rather than as routine release notes.
7. What happens next
The next development to watch for is the technical report. LNbits said it will publish a separate document setting out the details of the exploit. No date has been given. That report should clarify how the attackers gained the ability to withdraw funds and whether the Paywall extension, the subject of the first warning, was the point of entry or only one part of a wider problem.
Two other questions remain open. The project has not disclosed how many installations were affected, and there is no public total for the funds lost across all of them. The single figure available is the amount one operator reported losing from his own server.
Until those answers arrive, the practical guidance for anyone running the software is settled. Operators should install version 1.7.0 before bringing a server back online, reset wallet keys, replace funding-source credentials, change any other secrets held in the settings, and rebuild on a new server if there is any sign that the old one was accessed. Users of services that run on LNbits may need to update the keys in their connected applications once operators have completed those resets.