LNbits, a widely-used Bitcoin Lightning wallet platform, released an emergency security patch Tuesday after attackers exploited multiple vulnerabilities across self-hosted instances, draining user funds.
The project urged all operators to immediately update to version 1.7.0, which patches authentication flaws, extension management weaknesses, and payment handling exploits. Installations running older versions remain vulnerable to active attacks.
LNbits issued its first warning Sunday, Nov. 8, telling operators to disable the Paywall extension. Within an hour, the project escalated to a hard shutdown directive, taking its own hosted instances offline as attacks continued. Ben Arc, LNbits creator, said on social media it had been "a very challenging few days" as the team raced to release the patch after both users and the project suffered losses.
One operator, Kevin Ravensberg, reported attackers exploited his instance by creating new accounts and withdrawing 2.3 million satoshis (0.023 BTC, roughly $1,694 at current prices) before he could shut down his server.
LNbits stressed that updating alone does not guarantee security if credentials were already compromised. The platform recommended operators reset wallet keys, rotate all funding source credentials, assume any secrets stored in LNbits settings are exposed, and migrate to a fresh server if they suspect a breach.
The platform, which processes merchant checkouts, tipping services, and paywalls on the Lightning Network, said it will publish a detailed technical report on the exploit at a later date. In May, Arc estimated approximately 200,000 operators run LNbits independently.
