LNbits Releases 1.7.0 Security Update Following Critical Exploit Discovery

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

Operators are urged to deploy the patch immediately, rebuild suspect servers, and rotate all wallet keys to prevent theft.

Key points

• LNbits detected a critical security vulnerability on Nov. 8, prompting the release of version 1.7.0 on Nov. 10.
• All instances running versions prior to 1.7.0 place funds at risk of theft, requiring mandatory upgrades or fresh server deployments.
• Operators must rotate user keys, funding-source macaroons, and integration secrets across services like LNDHub and NWC Provider.

Lightning Network accounting platform LNbits issued an urgent security release on Nov. 10, 2026, directing all node operators to upgrade to version 1.7.0 following an exploit identified on Nov. 8 [1]. The software maintainers warned that all releases prior to version 1.7.0 harbor vulnerabilities that place hosted funds at direct risk of theft [1].

According to the development team, simply patching existing instances may be inadequate if unauthorized access occurred before the update [1]. In an official advisory, LNbits advised node administrators who suspect a breach to deploy version 1.7.0 on an entirely fresh server, preserve diagnostic logs, and execute a full credential reset [1]. Super administrators must rotate all user wallet keys, revoke and reissue funding-source credentials such as API keys and Lightning Network macaroons, and cycle system secrets [1]. Integrated extensions—including LNDHub, Nostr Wallet Connect (NWC) Provider, Bolt Cards, TPOS, Bleskomat, and FOSSA—require revoked connections and newly issued authorization tokens [1].

Hot Wallet Safeguards and Incident Review

The vulnerability emphasizes the persistent counterparty and technical risks tied to hot wallet management across layer-2 infrastructure. Similar infrastructure challenges have surfaced elsewhere in the Bitcoin ecosystem, such as when BTCPay Server released an emergency patch following an exploited LND vulnerability. LNbits reiterated that because hot wallets maintain spending credentials on live, internet-facing servers, operators should limit balances to day-to-day liquidity needs and route reserve capital to offline cold storage [1]. At the time of writing, $BTC traded around $73,416.

LNbits stated that comprehensive details explaining the mechanics of the exploit will be disclosed in a forthcoming post-incident report [1].

Sources

1. LNbits 1.7.0: security update and upgrade guidance — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.