LNbits patches wallet drains and tells operators to reset every key

LNbits, the open-source Lightning wallet and accounts server, published version 1.7.0 on Nov. 10 as an urgent security release after attacks that began on Nov. 8 emptied funds from some self-hosted instances. In its upgrade guidance on news.lnbits.com, the project says every version before 1.7.0 is affected and that funds running on those versions "are at risk of being stolen."

The warnings came in quick succession on Sunday. At 12:33 UTC LNbits told operators on X to disable its Paywall extension while it checked a possible bug. Less than 90 minutes later it told all users to stop their servers "IMMEDIATELY," citing "a wave of attacks," and it then disabled every instance on its own hosted service.

Why upgrading alone is not enough

The project's core point is that the patch closes the hole but does not lock out anyone who already got in. "Credentials exposed before the upgrade may still give an attacker access afterwards," the guidance says. LNbits asks operators to treat every secret stored in their settings as compromised.

The recovery list is long. If a compromise is suspected, operators should preserve logs and install 1.7.0 on a fresh server. A Super Admin has to run Reset Wallet Keys for all users, which breaks every connected app until it gets the new keys. Funding-source credentials such as API keys or macaroons must be revoked and replaced at the node, and connections in the NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA extensions have to be deleted and recreated.

That lands hardest on the small businesses that run LNbits as a back end: merchants with point-of-sale terminals, Bolt Card issuers, paywalls and tipping bots. The pattern resembles the BTCPay Server hot-wallet thefts covered here earlier, where self-hosted payment software held spendable keys online. As the stolen Keystone authentication key case showed, a leaked credential stays dangerous until it is actually replaced.

What is still unknown

LNbits has not described the exploit or said how many instances were hit; it promises a separate technical report. One public loss figure exists. Kevin Ravensberg, an LNbits operator, said attackers created new accounts on his instance and withdrew about 2.3 million satoshis, roughly 0.023 BTC, before he could shut it down, Cointelegraph reported.

The 1.7.0 release on GitHub bundles the fixes with new features, including TOTP two-factor authentication, BOLT12 offer payments and on-chain wallets. LNbits itself describes the software as a hot wallet and advises keeping only day-to-day balances on it, with the rest sent to an on-chain wallet whose keys stay offline.