LNbits issues emergency patch after Bitcoin wallet theft reports

Traders Union
All News
Crypto
LNbits issues emergency patch

Highlights

LNbits released emergency version 1.7.0 on Tuesday to patch vulnerabilities affecting all earlier versions, warning that unpatched installations remain at risk of theft.
Operators are urged to reset wallet keys, replace credentials, and consider new servers if breaches are suspected, as secrets stored in LNbits settings may be compromised.
An exploit enabled attackers to steal 2.3 million satoshis from a user, with about 200,000 self-hosted LNbits installations underscoring significant operational risks for businesses and individuals.

Critical update and attack timeline

As reported by Cointelegraph, LNbits on Tuesday published version 1.7.0 as an emergency release aimed at fixing vulnerabilities and tightening authentication, extension management and payment handling. The project says all versions before 1.7.0 are affected and that funds remain at risk of theft.

LNbits first warns operators on Sunday to disable its Paywall extension while it investigates a possible vulnerability. Just over an hour later, it urges users to shut down their LNbits servers immediately as attacks spread, and it also takes its own hosted installations offline.

In a message posted on X, creator Ben Arc says the past few days have been challenging as the team works to push out the new release after both users and the project suffer losses. LNbits says updating alone is not enough if credentials were already exposed before the patch is installed.

Operator risks and broader crypto impact

The project advises operators to reset wallet keys, replace funding-source credentials and treat secrets stored in LNbits settings as compromised. It also recommends moving to a fresh server where a breach is suspected, underscoring the operational risk for self-hosted wallet users and businesses that rely on LNbits for merchant checkouts, tipping services and paywalls.

LNbits has not yet explained the exploit in detail or said how many users are affected, though it says a separate report will follow. One user, Kevin Ravensberg, says attackers exploited his instance and withdrew about 2.3 million satoshis, or 0.023 Bitcoin, through newly created accounts before he could shut down the server.

Ben Arc said in May that about 200,000 people run the software themselves. That scale means the incident is likely to draw close attention across the crypto sector, where wallet software security and credential management remain central to fund protection.

We recently reported on Cohere’s AISLE acquisition, aimed at adding AI-driven software vulnerability detection to its enterprise security push.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.