LNbits released version 1.7.0 on Tuesday after attacks drained funds from installations running its Bitcoin Lightning wallet software. The project warned on Sunday to disable its Paywall extension, then ordered a full shutdown an hour later as attacks spread. LNbits took its own hosted servers offline and said the vulnerability affects all versions before 1.7.0. Creator Ben Arc said in May that about 200,000 people run the software themselves. One operator, Kevin Ravensberg, reported losing 0.023 BTC through newly created accounts before shutting down his server.
The patch addresses flaws in authentication, extension management and payment handling, but LNbits warned that upgrading alone does not secure compromised installations. Operators must reset wallet keys, replace funding-source credentials and treat all secrets stored in settings as exposed. The instruction to rotate credentials after patching suggests attackers could maintain access through previously harvested tokens or keys—an inference from the explicit warning that updating the software is insufficient. LNbits has not disclosed how many instances were hit or detailed the exploit mechanism; a technical report is expected later.
The vulnerability is application-specific, confined to LNbits installations. The software provides merchant checkouts, tipping services and paywalls; the exploit targeted self-hosted instances, not the Lightning Network protocol or custodial providers. No contagion mechanism to broader Bitcoin network security or on-chain funds exists. The fix is deployed, and the market shows no Lightning risk pricing from this event. Fear and Greed dropped to 29 from a 30-day average of 45, but no catalyst connects LNbits cleanup to Bitcoin or Lightning infrastructure positioning.
Source: CoinTelegraph