LNbits Ships Emergency Security Update After Users Report Bitcoin Wallet Losses
•
November 10, 2026 11:12 pm
•
Comments
LNbits has released an urgent security update after users reported Bitcoin losses from self-hosted wallet instances.
The project is telling every operator to move to version 1.7.0 immediately. Reports of unauthorized withdrawals give the warning real financial stakes.
Reports of Real Losses Put Pressure on the Release
Cointelegraph reported that LNbits rushed the update after operators described unauthorized withdrawals from their instances, including one report involving more than 2.28 million satoshis. The timing turned a software-upgrade story into an operational security event for people running real Lightning wallets.
LNbits is self-hosted software, so exposure depends on how each instance was deployed, configured, and connected. That also means operators—not a centralized exchange—must make the upgrade decision and verify their own systems.
The report did not establish one universal loss figure for every affected user, and it would be wrong to treat one operator’s experience as the total impact. It did establish that the risk was more than theoretical for at least some people running the software.
My LNbits instance (https://t.co/r4lXAqO5ZR) got exploited before this announcement, 2,285,545 sats got withdrawn by new accounts that used this exploit before I could stop the server. Attack started at 9:22 and continued till 14:00 (UTC). All https://t.co/6rNfkA0EgM users will…
— Kevin Ravens₿erg ⚡️ (@KevinR4v) November 8, 2026
That post gives the incident a concrete scale: 2,285,545 satoshis is 0.02285545 BTC. It also describes an attack window lasting several hours before the server was stopped.
What Version 1.7.0 Changes
The project’s official v1.7.0 release calls the update critical and says it contains extensive security hardening, vulnerability fixes, and added protections across authentication, extension management, and payment handling. LNbits explicitly tells all users to update immediately and to prioritize the upgrade over normal operations.
The release also adds TOTP-based two-factor authentication and automatic extension updates, both meaningful controls for software that can sit close to live funds. It includes fixes across payment handling, wallet behavior, notifications, WebSockets, dependencies, and administrative functions.
There are major feature additions too, including on-chain wallets, BOLT12 payments, NIP-17 support, a job scheduler, and improved WASM extensions. Those features matter, but operators should treat the security changes—not the feature list—as the reason to move now.
Anyone running LNbits should back up the instance according to the project’s secure-update guidance, install the verified release, review extensions, and inspect wallet activity. An upgrade does not reverse a prior unauthorized withdrawal, so affected operators still need to preserve logs and reconcile balances.
It's been a very challenging few days, working relentlessly to get the v1.7 release out after our users and we suffered losses. But what has blown all of us developers away is just how gracious and understanding the community has been. Thank you sincerely for all the support. https://t.co/c4N7hqXnPA
— Ben Arc 🏴✊⚡️ (@arcbtc) November 10, 2026
Ben Arc’s statement is notable because it acknowledges losses on both the user and developer sides while describing the push to get v1.7 out. That is stronger language than a generic precautionary patch notice.
Self-custody removes a centralized gatekeeper, but it does not remove software risk. LNbits operators now have a clear next step: update first, then verify that their own instance and funds are intact.
Join the conversation!
We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.