LNbits pushes emergency patch after reported Bitcoin wallet thefts

LNbits has told users to update immediately after a wave of attacks on LNbits instances led to stolen funds. The interesting part for payment operators is that the fix is not just “install version 1.7.0 and carry on” — the project says compromised credentials can still leave an installation exposed even after upgrading.

1. LNbits published version 1.7.0 on Tuesday and described it as a critical release covering vulnerabilities in authentication, extension management and payment handling. The project said the issue affects all versions before 1.7.0 and can put funds at risk of theft.
2. Ben Arc, LNbits’ creator, said on X: “It’s been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses.” LNbits provides software for Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls.
3. On Sunday, LNbits first warned operators to disable its Paywall extension while it investigated a potential vulnerability. Just over an hour later, it told users to shut down their LNbits servers immediately, citing a wave of attacks, and it also took its own hosted installations offline.
4. LNbits said updating alone would not protect installations whose credentials had already been compromised. It urged operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised; if a compromise is suspected, the project recommended moving to a fresh server.
5. One user, Kevin Ravensberg, said attackers exploited his LNbits instance and withdrew about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut down the server. LNbits said a separate report detailing the exploit would follow.

In May, Ben Arc said about 200,000 people run the software themselves. That number matters because self-hosted wallet and checkout infrastructure tends to fail in the least convenient way possible: the operator owns the server, but the attacker may own the credentials.