-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0336 ============================================================ Advisory-ID: 0xCERT-2026-0336 Severity: Critical Published: 2026-11-10T16:20:58.000Z Updated: 2026-11-11T00:43:27.212Z Chains: Bitcoin URL: https://www.0xcert.com/advisory/0xCERT-2026-0336 Title: LNbits 1.7.0 security release: all earlier versions at risk of fund theft; upgrade and rotate keys before restarting Summary - ------- LNbits 1.7.0 fixes the vulnerabilities exploited since 8 November 2026 to drain funds from LNbits instances; LNbits says funds on all earlier versions are at risk. Upgrade before restarting, then reset wallet keys and rotate funding-source and extension credentials. Details - ------- Summary LNbits has released version 1.7.0 as a security update after the attacks discovered on 8 November 2026 (0xCERT-2026-0330), in which attackers created accounts on LNbits instances and withdrew Lightning funds without authorization. LNbits states that funds running on versions prior to 1.7.0 are at risk of being stolen. Operators who stopped their servers on LNbits' instruction should upgrade, then rotate keys and credentials, before restarting. Affected - - LNbits (self-hosted Bitcoin Lightning accounts/wallet system), all versions prior to 1.7.0 - - Fixed in 1.7.0 (published 10 November 2026; PyPI package lnbits 1.7.0) Impact LNbits has not yet published technical details; it says a separate report with full details of the exploit will follow. Exploitation in the wild was confirmed in the 8 November incident (one operator reported losing about 2,285,545 sats, per SlowMist). LNbits notes that upgrading alone cannot remove access an attacker may already have obtained. Recommended actions - - Upgrade to LNbits 1.7.0 before running the server again. If you suspect compromise, preserve logs and prefer a fresh server installed with 1.7.0. - - As Super Admin, reset all wallet keys (Settings > Users > Reset Wallet Keys); users must then update connected apps and integrations with the new keys. - - Revoke and replace funding-source credentials (for example LND macaroons, CLN runes, Eclair or phoenixd API passwords), then update the funding-source settings in LNbits. - - Treat any other secrets stored in LNbits settings as compromised and replace them. - - Revoke and recreate connections in extensions such as NWC Provider, LNDHub, Bolt Cards, TPoS, Bleskomat and FOSSA. - - Keep only day-to-day funds in the hot wallet and review balances and outgoing payments regularly. Source & attribution This 0xCERT advisory summarises the LNbits team's security update and upgrade guidance: https://news.lnbits.com/news/lnbits-1-7-0-security-update (release: https://github.com/lnbits/lnbits/releases). Incident context from LNbits (https://x.com/lnbits/status/2119428804951048237) and SlowMist (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record. References - ---------- - - https://news.lnbits.com/news/lnbits-1-7-0-security-update - - https://github.com/lnbits/lnbits/releases - - https://pypi.org/project/lnbits/1.7.0/ - - https://x.com/lnbits/status/2119428804951048237 - - https://www.0xcert.com/advisory/0xCERT-2026-0330 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrzxIQJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmdyJfvGa/g1XUtDVUB029xqrA0IWua1CyPKu0y0 f69n4hYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABZGwD/SbqFHuEm6l7qChH5 d4y7fIlX/0H07+Yd3S3S1dPJVvcBANAkyhgyj5HCUyuiBt/0zZlzJX4/rSPC YrG0Hm5kVVED =g5Qz -----END PGP SIGNATURE-----