LNbits Urges Users to Install Emergency Patch After Reported Wallet Thefts

Bitcoin Lightning wallet platform LNbits urged users to update immediately after reporting attacks on LNbits instances that resulted in stolen funds. According to Cointelegraph, the project released version 1.7.0 on Tuesday, calling it a critical update that addresses vulnerabilities and strengthens authentication, extension management and payment handling. LNbits cautioned that installing the update may not protect systems if attackers have already obtained their credentials. Creator Ben Arc said on X that the team had worked relentlessly to release version 1.7.0 after users and the project suffered losses. LNbits software is used to run Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls. Arc said in May that about 200,000 people run the software themselves. The project first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability, then urged them just over an hour later to shut down their servers immediately as attacks escalated. LNbits also took its hosted installations offline. LNbits has not disclosed details of the exploit or the number of affected users. The project said the vulnerability affects all versions before 1.7.0 and could put funds at risk of theft. It also warned that credentials exposed before an upgrade could continue to give attackers access afterward. Operators were advised to reset wallet keys, replace funding-source credentials and consider secrets stored in LNbits settings compromised. The project recommended moving to a fresh server if an installation is suspected to have been breached. Cointelegraph contacted Arc and LNbits for comment. One user, Kevin Ravensberg, said attackers exploited his LNbits instance and withdrew about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut down the server. LNbits said it would publish a separate report detailing the exploit. The project’s warning and emergency release followed a wave of attacks, while key information about the method used and the scale of the incident remained undisclosed.