LNbits 1.7.0 Security Update: How to Secure Lightning Wallets

Quick answer: LNbits released version 1.7.0 on 10 November 2026 after attackers drained bitcoin from self-hosted Lightning wallets using a flaw in earlier versions. Every version before 1.7.0 is affected. Operators should update, reset all wallet keys, replace funding-source credentials and reconnect extensions. Users on someone else's server should confirm it has been patched.

What happened with LNbits?

LNbits is open-source software that sits on top of a Lightning node or payment provider and lets an operator create many separate wallets, plus extensions such as point-of-sale terminals, Bolt Cards and Nostr Wallet Connect. Many small merchants, communities and hobbyists self-host it.

On Sunday, 8 November 2026, LNbits warned operators about an actively exploited vulnerability. It first advised disabling the Paywall extension, then urged operators to shut their servers down because attacks were ongoing, according to CryptoTicker. LNbits also took its own hosted instances offline.

On 10 November the project released version 1.7.0, which it describes as a critical security update. SpendNode reports the release was published on GitHub at 17:09 UTC that day.

LNbits has not yet published the technical details of the flaw and has said a detailed report will follow. The 1.7.0 release includes hardening of authentication, extension management and payment handling, but the notes do not say which change closes the attack path.

How the attacks played out

No total loss figure has been published. One operator reported losing about 2.3 million sats (roughly 0.023 BTC). CryptoMeter reports that attackers created unauthorised accounts on his server and withdrew funds before he could shut it down. LNbits founder Ben Arc acknowledged that users and developers had suffered financial losses.

The account-creation pattern suggests attackers gained rights they should not have had, but LNbits has not confirmed the mechanism. Until the technical report is out, operators should assume any secret stored in LNbits settings on a pre-1.7.0 server could have been exposed.

Who is affected?

• Self-hosting operators running any LNbits version below 1.7.0.
• Users with wallets on someone else's LNbits server, such as a merchant, community or meetup instance.
• Bolt Card holders and point-of-sale users whose cards or terminals are linked to an LNbits instance.
• Anyone who connected an app through NWC or LNDHub to an LNbits wallet.

The flaw is in LNbits, not in the Lightning Network protocol or in bitcoin itself. Lightning wallets that do not use LNbits are not affected by this issue.

Step-by-step: securing an LNbits server

Step 1: Update to 1.7.0

Install LNbits 1.7.0 from the official project repository. If you suspect the server was compromised, consider a fresh install rather than an in-place upgrade, and keep the old system's logs for later analysis.

Step 2: Reset all wallet keys

1.7.0 adds a superuser function to reset every wallet's keys at once. According to CryptoTicker, it is found in the super admin area under the Users section of settings, labelled "Reset Wallet Keys". After resetting, give each user their new keys or wallet links through a trusted channel.

Step 3: Replace funding-source credentials

Revoke and recreate the API keys or macaroons that LNbits uses to talk to your Lightning node or payment provider. If an attacker read your settings, the old credentials could let them pay out from the node directly.

Step 4: Recreate extension connections

Reported guidance names six extensions whose connections should be revoked and recreated: NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA. Other secret values stored in LNbits settings should also be treated as compromised and replaced.

Step 5: Turn on the new protections

1.7.0 adds TOTP two-factor login and automatic extension updates. Enable two-factor authentication for admin accounts.

Step 6: Reduce the hot balance

Keep only the funds you need for day-to-day operations on the node behind LNbits. Move the rest to an offline or cold wallet.

If you use someone else's LNbits wallet

1. Ask the operator directly whether their server runs 1.7.0 and whether wallet keys were reset.

2. Stop using old wallet links, LNDHub logins and NWC connections once the operator has reset keys. They will no longer be valid and should not be trusted.

3. Request a new Bolt Card pairing if your card was linked to the affected server.

4. Move larger balances to a wallet you control while the situation settles.

Quick checklist for operators

Use this list to confirm you have covered everything before reopening a server to users:

• LNbits shows version 1.7.0 or later on the admin page.
• All wallet keys have been reset, and users have received new keys through a trusted channel.
• The funding-source macaroon or API key has been revoked on the node or provider side and replaced.
• NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA connections have been recreated.
• Admin accounts use strong unique passwords and TOTP two-factor login.
• The node's balance has been reduced to an operating float.
• Old server logs have been saved in case the upcoming technical report gives indicators to look for.

When LNbits publishes its full technical report, compare it against those logs. It may reveal whether your server was targeted even if no funds moved.

What to avoid

• Running old versions "just for a few minutes." Attacks were active, and a short window is enough.
• Reusing old keys or macaroons after updating.
• Unofficial patch downloads. Get 1.7.0 only from the official LNbits repository and channels.
• Fake "LNbits support" messages. No one legitimate will ask for your node seed or admin password.

How this compares with other wallet incidents

Software-level wallet incidents usually end with the same advice: patch, rotate secrets and move funds to fresh keys. We saw that with the FomoPeek iOS wallet key exposure and the D'CENT app wallet security alert. For another Bitcoin-adjacent case, see our coverage of the Liquid Network hack. And when a compromise reaches the website or app layer rather than the wallet, revoking permissions is the priority, as in the Across domain hijack guide.

Sources

• CryptoTicker: LNbits flaw: update to 1.7.0 and rotate your keys (11 November 2026)
• SpendNode: LNbits Patches Bitcoin Wallet Software After Reported Thefts (11 November 2026)
• CryptoMeter: LNbits Releases Emergency Security Patch After Bitcoin Wallet Theft Reports (11 November 2026)

Frequently asked questions

Conclusion

The LNbits flaw was actively exploited, and the fix requires more than a version bump. Operators should move to 1.7.0, reset wallet keys, rotate node credentials and rebuild extension connections. Users of hosted LNbits wallets should confirm their operator has done the same, and keep only small balances on any hot Lightning setup.

This article is for general information only and is not financial or security advice for your specific setup. The Onchain Support is an independent publication and is not affiliated with LNbits or any wallet provider or exchange. We will never ask for your seed phrase, private keys, passwords or 2FA codes.