Key Highlights:
- LNbits released version 1.7.0 as an urgent security update following an exploit discovered on November 8, 2024, that drained user funds.
- Kevin Ravensberg reported a loss of 2,285,545 satoshis from Telegram tipping service BitTipBot after attackers created unauthorized accounts.
- Node operators running versions prior to 1.7.0 face critical fund-drain risks and are urged to rotate credentials or provision entirely fresh servers.
LNbits Rolls Out Urgent v1.7.0 Security Patch Following System Exploits
The developers of open-source Bitcoin Lightning platform LNbits have released version 1.7.0 in direct response to an active vulnerability discovered on November 8. The security release addresses vulnerabilities that allowed malicious actors to access backend funds across live deployments. According to the official upgrade guidance published alongside the release, versions prior to 1.7.0 are affected and funds running on prior versions of LNbits are at risk of being stolen.
The development team noted that version 1.7.0 provides comprehensive security remediations and indicated that an exhaustive technical post-mortem detailing the mechanics of the exploit will be published in due course.
The real-world fallout of the exploit was confirmed publicly by Kevin Ravensberg, operator of the Telegram tipping service BitTipBot. Ravensberg stated that attackers registered new accounts on his LNbits instance and successfully siphoned 2,285,545 satoshis (roughly 0.0229 BTC) during an attack window lasting from roughly 09:22 to 14:00 UTC on November 8. While individual node runners have disclosed distinct losses, the LNbits project has not released an aggregate calculation of the total funds stolen across all affected network instances.
Critical Recovery Protocols and System Hardening Guidelines
Due to the depth of potential compromises, the software maintainers emphasized that standard binary updates may be insufficient for instances that were actively targeted. System administrators and operators who suspect their infrastructure has been accessed are explicitly instructed to deploy completely fresh servers, as updating software alone cannot purge backdoors or persistent access acquired during an intrusion.
For existing servers, the required remediation workflow involves logging in as Super Admin to rotate all user wallet keys, replacing every funding-source credential (including macaroon files and API keys), and updating secrets embedded in application settings. Operators must also audit, revoke, or reconfigure active connections for multiple core extensions, specifically including NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA. The project reiterated core operational hygiene, warning that LNbits inherently acts as a hot wallet; node runners are advised to store only strictly necessary liquidity on live nodes, audit logs continuously, and secure surplus capital using offline cold-storage solutions.
Feature Additions and Ecosystem Role
Beyond emergency security patches, LNbits 1.7.0 introduces substantial structural hardening across extension management, authentication channels, and internal payment routing, alongside third-party dependency updates. The update also packages several new functionality features, such as native on-chain wallet integration, BOLT12 offer payments, TOTP two-factor authentication, NIP-17 support, a task scheduler, automatic extension update capabilities, and hold invoice mechanisms designed for the primary LNbits funding backend.
Originally established in 2019 by Ben Arc as a free, open-source software initiative, LNbits later established a corporate entity to finance ongoing engineering. The suite functions as an extensible accounting layer on top of Lightning daemons such as LND and Core Lightning, allowing administrators to allocate isolated, multi-user accounts and applications. In a September 2024 profile, Bitcoin Magazine characterized the software as the WordPress for your Bitcoin Lightning node
underscoring its pivotal position in enabling modular point-of-sale systems, automated tools, and business workflows for both self-hosted servers and managed web environments.
Why This Matters
LNbits serves as an essential modular infrastructure layer across the broader Bitcoin Lightning Network. Because a large number of independent merchants, point-of-sale operators, and community services rely on LNbits extensions like LNDHub and Bolt Cards, an exploit targeting multi-tenant accounting poses immediate counterparty and liquidity risks. The November 8 exploit highlights the operational complexities of maintaining hot-wallet environments on active routing nodes. The project’s impending technical disclosure will offer crucial security lessons for downstream developers building custodial interfaces, automated bot integrations, and multi-tenant applications atop the Lightning protocol.
Frequently Asked Questions
Which LNbits deployments are vulnerable to the exploit?
All LNbits releases prior to version 1.7.0 are vulnerable. The project team warned that funds on unpatched instances remain at immediate risk of theft until the upgrade and credential rotations are completed.
Is applying the version 1.7.0 update enough to secure an affected node?
Not if the node was already infiltrated. LNbits maintainers advise operators who suspect unauthorized access to provision a fresh server entirely, rotate all Super Admin and user wallet keys, reissue backend funding credentials (such as API keys and macaroons), and re-establish configurations for linked extensions.
What new features are included in LNbits 1.7.0?
In addition to critical security and authentication fixes, version 1.7.0 introduces on-chain wallet support, BOLT12 offer processing, TOTP two-factor authentication, NIP-17 integration, an internal job scheduler, automatic extension updates, and hold invoice compatibility.
