Update your LNbits or lose your sats: v1.7.0 patches a wallet-sized hole ⚡

LNbits, a platform for self-hosted Bitcoin Lightning wallets and payment applications, published version 1.7.0 on Tuesday as a critical emergency release following a wave of reported attacks on LNbits instances that resulted in stolen funds, urging users to update immediately. The project described the release as addressing vulnerabilities and strengthening authentication, extension management and payment handling, but warned that updating alone would not protect installations whose credentials had already been compromised.

The company first warned operators on Sunday to disable its Paywall extension while it investigated a potential vulnerability. Just over an hour later, LNbits urged users to shut down their LNbits servers immediately, citing a wave of attacks, and also took its own hosted installations offline. In its announcement accompanying the emergency patch, LNbits said the vulnerability affects all versions before 1.7.0 and puts funds at risk of theft, recommending that operators reset wallet keys, replace funding-source credentials, treat secrets stored in LNbits settings as compromised and move to a fresh server if a compromise is suspected. The company said a separate report detailing the exploit would follow and has not yet disclosed the exploit itself or how many installations were affected.

"It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," LNbits creator Ben Arc said on X. Arc said in May that about 200,000 people run the software themselves.

One user, Kevin Ravensberg, said attackers exploited his LNbits instance, withdrawing about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he was able to shut down the server. Cointelegraph reached out to Ben Arc and LNbits for comment.

LNbits provides software for running Bitcoin Lightning wallets and payment applications, including merchant checkouts, tipping services and paywalls, with the project's own hosted service also taken offline during the response.