LNbits security flaw: version 1.7.0 stops thefts from Lightning wallets

If you run your own LNbits server, you need to act now: every version before 1.7.0 contains a security flaw that attackers have used to drain bitcoin from Lightning wallets. The project released version 1.7.0 on November 10, 2026, and says an update alone is not enough if credentials have already leaked. Operators should therefore also reset all wallet keys and replace the credentials of their funding source.

For investors who hold bitcoin only on an exchange or in an ordinary app, nothing changes. Those affected are people and organisations that installed LNbits themselves, and anyone using a Lightning account on someone else’s LNbits server, for example through a Bolt Card or a shop’s checkout.

LNbits security flaw: what has been known since November 8

According to the project, the vulnerability was discovered on Sunday, November 8, 2026. According to Cointelegraph, LNbits first advised that day to disable the Paywall extension while the investigation was under way. Around an hour later came the far more urgent request to shut down all LNbits servers immediately, because a wave of attacks was in progress.

The official security notice for version 1.7.0 states that funds on all older versions are at risk of theft. LNbits has not yet disclosed exactly how the attack works technically. A separate report with details of the exploit is to follow. An exploit is an attack path that uses a specific weakness in software to do something the operator has not allowed.

It is therefore also unclear which of the many changes in 1.7.0 closes the path that was used. The specialist site SpendNode points out that the release notes do not make this link. For operators, this means it cannot be established with certainty whether their own instance was attacked through this particular flaw. Anyone who had an older version online is better off assuming the worst.

Lightning software LNbits: one server for many small accounts

LNbits is free software that sits on top of a Lightning funding source and uses it to manage any number of sub-accounts. The Lightning Network is a payment network on top of the bitcoin blockchain through which small amounts move in seconds for a fee of a few satoshis. A satoshi is one hundred millionth of a bitcoin.

The funding source can be a Lightning node of your own running LND or Core Lightning, a payment provider or another LNbits instance. LNbits itself holds no private keys for bitcoin on the blockchain. It does, however, hold the credentials for the funding source and the keys of the individual wallets. Anyone who gets hold of this data can trigger payments up to the available balance.

That is exactly why the software is popular: a club, a café or a merchant can run many accounts, checkouts and cards from a single node. LNbits founder Ben Arc said in May that around 200,000 people run the software themselves; Cointelegraph quotes the figure. It cannot be verified independently, but it shows the order of magnitude.

If you generally prefer to hold your coins without a server of your own, the software wallet comparison sets out the differences between app wallets. Bitcoin itself traded at around $73,800 on the morning of November 11, according to CoinGecko; the longer-term view is in our bitcoin price prediction.

Emergency shutdown: LNbits took its own hosted instances offline

Besides warning self-hosting operators, LNbits also acted on its own systems. According to Cointelegraph, the project took its own hosted installations offline. Anyone with an account there temporarily could not reach their balance, but was also protected against further outflows through the flaw.

For a hot wallet, a hard shutdown is the only measure that works immediately. A hot wallet is a wallet whose keys sit on an internet-connected computer and which can therefore trigger payments at any time. As long as the attack path is open, only a switched-off server prevents more satoshis from flowing out.

Security update 1.7.0: login, extensions and payments overhauled

The new version appeared on GitHub on November 10, 2026. LNbits describes it there as a critical security update with extensive hardening and important fixes to vulnerabilities. The changes cover three areas: login, extension management and payment processing. The release is headed by a call for all users to update immediately.

New features include a function that lets the super admin reset all wallet keys of an instance at once. According to SpendNode, two-factor login via a TOTP app and automatic updates for extensions have also been added. TOTP stands for time-based one-time passwords, the kind authenticator apps generate every 30 seconds.

LNbits requires that no server be started with an older version any more. Only with 1.7.0 may the instance run again.

Damage from the exploit: 2.3 million satoshis at one operator

LNbits has not given a total amount, nor the number of affected instances. So far one individual case has been documented publicly: according to Cointelegraph, an operator described how attackers drained around 2.3 million satoshis from his instance via newly created accounts before he could shut the server down. That is 0.023 bitcoin, around $1,700 at the November 11 price.

The route via newly created accounts is notable. Many observers see it as a sign that attackers obtained rights within the instance to which they were not entitled. LNbits has not confirmed this reading. According to Cointelegraph, Ben Arc spoke of challenging days in which the team finished version 1.7 after users and the project itself had suffered losses.

Measured against big exchange hacks, the known damage is small. For operators, though, something else counts: an LNbits server with access to a Lightning node can, in the worst case, lose the node’s entire outgoing balance, not just the money in a single account.

How to protect yourself from the LNbits exploit

What happened: On November 8, 2026, a security flaw was discovered in LNbits that attackers used to drain funds from self-hosted Lightning instances. All versions before 1.7.0 are affected; the fix was released on November 10. No total figure for the damage is known; one operator reported losing around 0.023 bitcoin, according to Cointelegraph (as of November 11).

Are you affected? Yes, if you ran an LNbits server on a version before 1.7.0 between the disclosure and your update, or use an account on such a server. No, if you hold bitcoin only on an exchange, in an ordinary wallet app or on a hardware wallet and none of the services you use runs on LNbits. Unusual new accounts and outgoing payments that nobody triggered show whether an instance was actually attacked.

1. Update to 1.7.0: Restart your LNbits server only after installing version 1.7.0, and keep older versions switched off for good.
2. New server if in doubt: If you see unknown accounts or unexplained payments, set up LNbits 1.7.0 on a freshly installed server and back up the old system’s log files first.
3. Reset wallet keys: As super admin, open the Users section under settings, choose “Reset Wallet Keys” and then give all users the new keys for their connected apps.
4. Re-secure the funding source: Revoke all API keys and macaroons that LNbits uses on the Lightning node or payment service, create new ones and enter them in the funding source settings.
5. Withdraw funds: Leave only the money needed for day-to-day operation on the server and transfer everything else to an on-chain wallet whose keys are kept offline.

Our guide on how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison lines up suitable devices.

NWC, LNDHub and Bolt Cards extensions: set up connections again

LNbits relies on extensions, and that is where part of the follow-up work lies. The security notice names six extensions whose existing connections operators should revoke or delete and recreate with new credentials: NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA.

The names stand for very practical applications. NWC stands for Nostr Wallet Connect, a method that lets apps remotely prompt a wallet to pay. LNDHub connects mobile wallet apps to the server. Bolt Cards are NFC cards for paying via Lightning at the checkout, and TPOS is a point-of-sale extension for merchants. Bleskomat and FOSSA are bitcoin ATMs connected through LNbits.

Each of these connections carries its own keys. Anyone who resets only the wallet keys but leaves an old NWC connection or an issued Bolt Card running may be leaving a door open. The project also treats all other secret values in the LNbits settings as compromised and recommends replacing them.

If you run a BTCPay Server alongside LNbits, you will find the basic rules for Lightning access in our article on securing BTCPay Lightning access.

A hot wallet on the server: only operating funds belong online

Perhaps the most important lesson comes at the end of the LNbits notice and applies well beyond this case. LNbits is a hot wallet, it says. Only the money needed for day-to-day operation should therefore sit on the server. Operators should check balances and outgoing payments regularly and move surpluses to an on-chain wallet with keys stored offline.

For a merchant with a Lightning checkout, that means a fixed routine: takings build up on the node during the day, and in the evening or weekly the surplus moves to a cold wallet. A cold wallet is the counterpart of a hot wallet; its keys sit on a device without a permanent internet connection. How the common devices for this differ is shown in the hardware wallet comparison.

If you do not want to maintain a server at all, a well-maintained app wallet is often the better choice. A Lightning server of your own brings independence, but it requires someone to notice updates like this one on a Sunday evening.

Bolt Card and club till: accounts on other people’s LNbits servers

Many Lightning users do not run LNbits themselves but only have an account there. Typical examples are bitcoin meetups that issue Bolt Cards to their members, cafés with a Lightning checkout, or services that give away a wallet via a link. These users cannot install the update themselves; everything depends on the operator reacting.

It makes sense to ask the operator directly: is the server running 1.7.0, have the keys been reset, and were there any suspicious outflows? Until you get an answer, no larger amount belongs in such an account. If you receive a new access link or a new card after the reset, use only those. Old links and cards are worthless afterwards, and in the worst case an attacker knows them too.

If, on the other hand, you buy and hold bitcoin on an exchange licensed in the EU, you are not affected by this flaw. Which providers hold a licence under the European MiCA regulation is shown in the comparison of regulated crypto exchanges.

LNbits 1.7.0: only new keys make the update effective

1. Install version 1.7.0, reset all wallet keys and replace your funding source credentials before the server accepts payments again. For reserves held outside the server, a device from the hardware wallet comparison is a good fit.
2. Set up the connections for NWC, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA again. For everyday use without a server of your own, the software wallet comparison helps you choose a well-maintained app.
3. Keep an eye on the error analysis LNbits has announced, and until then keep only operating funds online. If you prefer to hold bitcoin with a licensed provider, you will find one in the comparison of MiCA-regulated exchanges.

(As of November 11, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)