LNbits flaw: update to 1.7.0 and rotate your keys

If you run your own LNbits server, you need to act now: every version before 1.7.0 contains a security flaw that attackers have used to drain bitcoin from Lightning wallets. The project released version 1.7.0 on November 10, 2026, and says an update alone is not enough if credentials have already leaked. Operators should therefore also reset all wallet keys and replace the credentials of their funding source.

For investors who hold bitcoin only on an exchange or in an ordinary app, nothing changes. Those affected are people and organisations that installed LNbits themselves, and anyone using a Lightning account on someone else’s LNbits server, for example through a Bolt Card or a shop’s checkout.

LNbits security flaw: what has been known since November 8

According to the project, the vulnerability was discovered on Sunday, November 8, 2026. According to Cointelegraph, LNbits first advised that day to disable the Paywall extension while the investigation was under way. Around an hour later came the far more urgent request to shut down all LNbits servers immediately, because a wave of attacks was in progress.

The official security notice for version 1.7.0 states that funds on all older versions are at risk of theft. LNbits has not yet disclosed exactly how the attack works technically. A separate report with details of the exploit is to follow. An exploit is an attack path that uses a specific weakness in software to do something the operator has not allowed.