LNbits ships emergency patch after Bitcoin wallet thefts

LNbits, a popular Bitcoin Lightning wallet system, shipped an emergency security update on 10 November 2026 after several users reported stolen funds. Version 1.7.0 is labeled an urgent security update, and the team told every operator to upgrade at once.

Cointelegraph reported the thefts and the patch on 11 November. The project's own GitHub release page confirms the update and its security label. LNbits said the flaw affects all versions released before 1.7.0 and puts user money at risk.

How the patch came together

Trouble surfaced on Sunday 8 November. LNbits warned operators about a possible flaw in its Paywall extension and asked them to switch the extension off. It also pulled its own hosted instances offline while it looked into the reports. The project held back technical detail, which is the normal way to handle a live flaw before most users have patched.

The fix landed two days later. At 17:09 UTC on 10 November, version 1.7.0 went out, the first release since version 1.6.2 on 18 September. It is a large update. Alongside the security work, it bundles new features such as two-factor login, on-chain wallets, BOLT12 payments and a job scheduler, plus fixes to authentication, extension handling and payment processing.

One more patch followed. On 11 November the team shipped version 1.7.1, a smaller release that rotates authentication keys. LNbits has not yet published a full account of how the attack worked. It said a separate report would follow.

What LNbits is, and who carries the risk

LNbits is free, open-source software that lets people run Bitcoin Lightning wallets on their own server. One Lightning node can be split into many wallets and accounts, each with its own balance and permissions. Merchants, community projects and developers use it to take Lightning payments without handing custody to a third party.

Lightning is Bitcoin's faster, cheaper payment layer, built for small transactions that would be slow and costly on the main chain. Tools like LNbits sit on top of it and make a single node usable by many people at once. Popularity brings a target. The more wallets a piece of software manages, the more an attacker stands to gain from one flaw.

That design is the appeal and the exposure. Running your own Lightning wallet is a form of self-custody, which hands over both the keys and the responsibility. There is no company holding the coins, and no support desk to call when something breaks. When the software itself has a hole, the operator wears the loss.

What users lost, and what is not known

One LNbits user, Kevin Ravensberg, said attackers created new accounts on his instance and withdrew about 2.3 million satoshis, or 0.023 Bitcoin, before he could shut the server down. At the Bitcoin price of $74,108 recorded by CoinGecko at 22:39 UTC on 11 November, with the market near a three-month low, that works out to roughly $1,700. Small, as crypto thefts go. For the person who lost it, not small at all.

No combined loss figure exists yet. LNbits has not said how many installations were hit, how much was taken in total, or how many operators have upgraded. That gap matters. Until the project publishes its report, the real scale is a guess, and the public count rests on a handful of self-reported cases.

Why updating may not be enough

Ben Arc, the LNbits creator, said the team had been "working relentlessly to get the v1.7 release out after our users and we suffered losses." Installing the fix shuts the door. It does not reverse a theft that already happened, and it does not clean a server an attacker has already reached.

That is why LNbits advised more than a version bump. It told operators to reset wallet keys, replace the credentials for their funding source, treat any secrets saved in the software as compromised, and move to a fresh server if they suspect a break-in. The 1.7.1 patch adds a tool that resets every wallet key at once. A straight upgrade on a compromised machine still trusts the old keys, so the extra steps are the point.

Open-source projects usually hold back the technical detail until users have had time to patch, then publish a full write-up. LNbits has done the first half. The second half, the exploit report, is what operators are waiting on, because it tells each of them whether their own instance was exposed and by which route.

What to watch

The promised exploit report is the next thing to look for. It should say which flaw was used, how many instances were drained, and whether the Paywall extension was the only way in. Operators still running older builds who have not acted are the group most at risk right now.

This fits a wider pattern in self-hosted crypto tools. The freedom to hold your own keys comes with the duty to patch fast and watch your own logs. A bank would carry a customer's loss. Here, the operator does. The next few days of disclosure will show how far the damage spread.