LNbits Warns of Attack on Self-Hosted Servers
LNbits says versions before 1.7.0 are vulnerable after withdrawals from self-hosted instances. Admins need to rotate keys and may need to rebuild servers completely.
Key Takeaways
- LNbits released version 1.7.0 as an urgent security update after withdrawals from self-hosted instances on November 8.
- All versions before 1.7.0 are affected; admins need to upgrade, rotate keys, and possibly rebuild servers.
- It is known that BitTipBot lost 2,285,545 satoshi; a full picture of the damage is still missing.
LNbits has released version 1.7.0 as an urgent security update after attackers withdrew funds from self-hosted LNbits instances on November 8. The project says admins should upgrade first and only then restart the server. If there are signs that a server has already been compromised, LNbits says they need to do more than just update and fully rebuild the environment.
What LNbits Is Asking For Now
According to the upgrade instructions, all versions before 1.7.0 are affected. LNbits warns that funds on older versions are at risk. Admins should therefore not only update the software, but also, as Super Admin, rotate all user wallet keys, replace the credentials for the funding source, and refresh other secrets. That also applies to integrations for extensions such as NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA.
The project already made it clear on November 8 that users needed to stop their servers immediately. LNbits also shut down the instances on its own hosted service at that time. So the release of 1.7.0 follows a period in which the project first tried to limit the damage and then made the patch available.
Known Damage Remains Limited
The only quantified damage known so far comes from Kevin Ravensberg, the admin of the Telegram tip service BitTipBot. He said attackers created new accounts on his instance and withdrew 2,285,545 satoshi, about 0.0229 BTC, between roughly 09:22 and 14:00 UTC on November 8. There is still no full picture of the damage across all affected instances.
Along with the security fixes, the release also includes hardening for authentication, extension management, and payment processing. LNbits also mentions new features such as on-chain wallet support, BOLT12 offer payments, and TOTP two-factor authentication. The project says it will still publish a full technical report on the vulnerability.
Why This Matters Beyond LNbits
For European crypto users, this incident shows how quickly a hot wallet setup can become risky if updates are left undone. Especially with self-hosted software, responsibility for patching, key management, and server hygiene sits entirely with the admin. That makes fast security updates not just a technical detail, but also a direct part of protecting BTC funds.