LNbits Releases 1.7.0 Security Update Following Critical Exploit Discovery
Operators are urged to deploy the patch immediately, rebuild suspect servers, and rotate all wallet keys to prevent theft.
At a glance
- What happened
- LNbits released version 1.7.0 on Nov. 10 to resolve a critical security exploit discovered on Nov. 8 that places user funds at risk.
- Why it matters
- All prior versions remain exposed to unauthorized fund drainage, requiring node runners to patch or rebuild servers and rotate all authentication secrets.
- Who is affected
- LNbits node operators, administrators, and users with connected applications relying on pre-1.7.0 instances.
- Takes effect
- 2026-11-10
- What's next
- LNbits will release a separate post-mortem report providing full details regarding the vulnerability and exploit mechanics.
- Primary source
- news.lnbits.com: LNbits 1.7.0: security update and upgrade guidance
Key points
- LNbits detected a critical security vulnerability on Nov. 8, prompting the release of version 1.7.0 on Nov. 10.
- All instances running versions prior to 1.7.0 place funds at risk of theft, requiring mandatory upgrades or fresh server deployments.
- Operators must rotate user keys, funding-source macaroons, and integration secrets across services like LNDHub and NWC Provider.
Lightning Network accounting platform LNbits issued an urgent security release on Nov. 10, 2026, directing all node operators to upgrade to version 1.7.0 following an exploit identified on Nov. 8 1. The software maintainers warned that all releases prior to version 1.7.0 harbor vulnerabilities that place hosted funds at direct risk of theft 1.
According to the development team, simply patching existing instances may be inadequate if unauthorized access occurred before the update 1. In an official advisory, LNbits advised node administrators who suspect a breach to deploy version 1.7.0 on an entirely fresh server, preserve diagnostic logs, and execute a full credential reset 1. Super administrators must rotate all user wallet keys, revoke and reissue funding-source credentials such as API keys and Lightning Network macaroons, and cycle system secrets 1. Integrated extensions—including LNDHub, Nostr Wallet Connect (NWC) Provider, Bolt Cards, TPOS, Bleskomat, and FOSSA—require revoked connections and newly issued authorization tokens 1.
Hot Wallet Safeguards and Incident Review
The vulnerability emphasizes the persistent counterparty and technical risks tied to hot wallet management across layer-2 infrastructure. Similar infrastructure challenges have surfaced elsewhere in the Bitcoin ecosystem, such as when BTCPay Server released an emergency patch following an exploited LND vulnerability. LNbits reiterated that because hot wallets maintain spending credentials on live, internet-facing servers, operators should limit balances to day-to-day liquidity needs and route reserve capital to offline cold storage 1. At the time of writing, $BTC traded around $73,416.
LNbits stated that comprehensive details explaining the mechanics of the exploit will be disclosed in a forthcoming post-incident report 1.
Sources
- [1] LNbits 1.7.0: security update and upgrade guidance — news.lnbits.com, November 10, 2026
Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.
The Daily Brief, in your inbox at 07:00 ET
Five stories, the numbers that moved, what to watch. Three minutes. No hype, no advice, unsubscribe in one click.
Get the big crypto stories first
A few alerts a day at most: major breaking news and the morning brief. Switch off anytime.
Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.