LNbits 1.7.0 security release: all earlier versions at risk of fund theft; upgrade and rotate keys before restarting

Summary

LNbits has released version 1.7.0 as a security update after the attacks discovered on 8 November 2026 (0xCERT-2026-0330), in which attackers created accounts on LNbits instances and withdrew Lightning funds without authorization. LNbits states that funds running on versions prior to 1.7.0 are at risk of being stolen. Operators who stopped their servers on LNbits' instruction should upgrade, then rotate keys and credentials, before restarting.

Affected

• LNbits (self-hosted Bitcoin Lightning accounts/wallet system), all versions prior to 1.7.0
• Fixed in 1.7.0 (published 10 November 2026; PyPI package lnbits 1.7.0)

Impact

LNbits has not yet published technical details; it says a separate report with full details of the exploit will follow. Exploitation in the wild was confirmed in the 8 November incident (one operator reported losing about 2,285,545 sats, per SlowMist). LNbits notes that upgrading alone cannot remove access an attacker may already have obtained.

Recommended actions

• Upgrade to LNbits 1.7.0 before running the server again. If you suspect compromise, preserve logs and prefer a fresh server installed with 1.7.0.
• As Super Admin, reset all wallet keys (Settings > Users > Reset Wallet Keys); users must then update connected apps and integrations with the new keys.
• Revoke and replace funding-source credentials (for example LND macaroons, CLN runes, Eclair or phoenixd API passwords), then update the funding-source settings in LNbits.
• Treat any other secrets stored in LNbits settings as compromised and replace them.
• Revoke and recreate connections in extensions such as NWC Provider, LNDHub, Bolt Cards, TPoS, Bleskomat and FOSSA.
• Keep only day-to-day funds in the hot wallet and review balances and outgoing payments regularly.

Source & attribution

This 0xCERT advisory summarises the LNbits team's security update and upgrade guidance: https://news.lnbits.com/news/lnbits-1-7-0-security-update (release: https://github.com/lnbits/lnbits/releases). Incident context from LNbits (https://x.com/lnbits/status/2119428804951048237) and SlowMist (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record.