LNbits ships an emergency 1.7.0 patch after weekend attacks on Lightning wallet servers, warning that funds on older versions are at risk

LNbits, a free open-source system for running Bitcoin Lightning wallets, released version 1.7.0 on Tuesday as an urgent security update, Bitcoin Magazine reported. The project's guidance warns that "funds running on prior versions of LNbits are at risk of being stolen," and tells operators to upgrade before restarting their servers.

The attacks began over the weekend. On November 8 LNbits told operators to stop their servers and switched off instances on its hosted service, saying patches were being prepared, The Hacker News reported. Kevin Ravensberg, who runs the Telegram tipping bot BitTipBot, said attackers created accounts on his server and withdrew 2,285,545 satoshis, about 0.023 bitcoin, between about 09:22 and 14:00 UTC that day. He has promised to repay his users.

Much is still unknown. The project has not publicly described how the attackers got in, no total of losses across servers has been published, and the number of affected servers is not known; a full technical report has been promised. For operators who suspect a compromise, the guidance advises building a fresh server and rotating wallet keys and stored credentials, because updating alone may not remove attacker access. The notice covers LNbits servers only, not Lightning nodes or other wallet software.