The open-source Bitcoin Lightning Network platform LNbits officially released version 1.7.0 on November 10, 2026, as an urgent security intervention following a wave of coordinated attacks that began on November 8, 2026, resulting in the theft of user funds. The project management team has instructed all service operators to immediately transition to the updated software version, warning that existing installations remain vulnerable and that prior, potentially compromised, credentials pose a persistent risk even after the patch is applied. The vulnerability affects every version of the software released prior to the 1.7.0 update.
How did the security exploit impact LNbits users?
The unauthorized activity surfaced over the weekend, prompting LNbits to initiate an emergency response. According to reports, attackers successfully created illegitimate accounts on various instances of the platform, enabling the withdrawal of user balances. Kevin Ravensberg, who operates the BitTipBot service, reported that his platform was breached between 09:22 and 14:00 UTC on November 8, resulting in the loss of approximately 2,285,545 satoshis, valued at roughly 0.0229 BTC. In response to the wave of unauthorized activity, the project temporarily deactivated its own managed hosted services and advised all third-party operators to cease their server operations to prevent further losses.
"It’s been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses," said LNbits creator Ben Arc on X, as reported by Cryptonews.net.
What technical measures must operators take to secure their instances?
The LNbits development team has emphasized that simply installing the 1.7.0 software update is insufficient for operators who believe their systems were breached prior to the fix. Because attackers may have already obtained administrative or user credentials, the project strongly advises that administrators should move their installations to entirely fresh server environments. The comprehensive recovery protocol requires operators to perform a full rotation of all user wallet keys, replace all funding-source credentials—including API keys and macaroons—and treat any sensitive information stored within the platform’s settings as compromised. Furthermore, operators are instructed to re-examine or delete existing connections linked to various extensions, such as NWC Provider, Bolt Cards, TPOS, LNDHub, Bleskomat, and FOSSA, to ensure that no backdoors remain active.
What are the core functions of the LNbits platform?
LNbits operates as a flexible, open-source software suite designed to function on top of a Bitcoin Lightning Network node, enabling users to manage multiple accounts and deploy a wide array of payment-focused extensions. Since its inception in 2019, the platform has gained popularity among businesses, merchants, and individual node operators as a versatile tool for creating paywalls, tipping services, and point-of-sale interfaces. By abstracting the complexity of the underlying Lightning infrastructure, such as Core Lightning or LND, the software allows for simplified transaction management. As of May 2026, developer Ben Arc estimated that approximately 200,000 individuals were self-hosting their own instances of the platform. The 1.7.0 update not only addresses the critical security vulnerability but also introduces new features, including on-chain wallet support, BOLT12 offer payments, and enhanced two-factor authentication via TOTP.
What is still unclear regarding the attack?
Despite the release of the emergency patch, the full extent of the financial damage remains unverified as the project has not disclosed the total number of impacted instances or the aggregate volume of stolen funds. While individual users like Kevin Ravensberg have shared details of their specific losses, a comprehensive public accounting of the stolen assets has not yet been provided by the development team. Furthermore, the precise technical mechanics of the exploit used to target the platform remain largely undisclosed. LNbits has pledged to release a detailed technical post-mortem report documenting the findings of their security investigation, but no timeline has been confirmed for that disclosure. The community currently awaits further clarity on how the vulnerability specifically interacted with the Paywall extension and other system components to facilitate the unauthorized account creation and fund withdrawals observed during the incident.
Sources: This report draws on coverage by Bitcoin Magazine, grafa.com, Cryptonews.net, bloomingbit, Menafn, Cointelegraph, Finanzen.net, Traders Union. The wording is our own.
Market Snapshot
| Asset | Price | 24h | Market Cap |
|---|---|---|---|
 Bitcoin BTC | $73,750 | -1.39% | $1483.2B |
 Ethereum ETH | $2,064 | -2.80% | $252.2B |
 BNB BNB | $680.31 | -1.31% | $89.5B |
 XRP XRP | $1.06 | -3.75% | $67.0B |
 Solana SOL | $82.91 | -3.71% | $49.0B |
 Dogecoin DOGE | $0.0681 | -2.59% | $10.7B |
 Cardano ADA | $0.175 | -2.06% | $6.6B |
Live data: CoinGecko — 2026-11-11 05:22 UTC
