---
title: "LNbits Releases 1.7.0 Security Update Following Critical Exploit Discovery"
description: "Operators are urged to deploy the patch immediately, rebuild suspect servers, and rotate all wallet keys to prevent theft."
url: https://basisdesk.news/news/lnbits-releases-170-security-update-exploit-discovery
published: 2026-11-11T01:26:42.710Z
modified: 2026-11-11T01:26:42.710Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [BTC]
tags: [lnbits, lightning-network, bitcoin, hot-wallets, vulnerabilities, node-security]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# LNbits Releases 1.7.0 Security Update Following Critical Exploit Discovery

Operators are urged to deploy the patch immediately, rebuild suspect servers, and rotate all wallet keys to prevent theft.

## At a glance

- **What happened:** LNbits released version 1.7.0 on Nov. 10 to resolve a critical security exploit discovered on Nov. 8 that places user funds at risk.
- **Why it matters:** All prior versions remain exposed to unauthorized fund drainage, requiring node runners to patch or rebuild servers and rotate all authentication secrets.
- **Who is affected:** LNbits node operators, administrators, and users with connected applications relying on pre-1.7.0 instances.
- **Takes effect:** 2026-11-10
- **What's next:** LNbits will release a separate post-mortem report providing full details regarding the vulnerability and exploit mechanics.
- **Primary source:** [LNbits 1.7.0: security update and upgrade guidance](https://news.lnbits.com/news/lnbits-1-7-0-security-update) — news.lnbits.com

## Key points

- LNbits detected a critical security vulnerability on Nov. 8, prompting the release of version 1.7.0 on Nov. 10.
- All instances running versions prior to 1.7.0 place funds at risk of theft, requiring mandatory upgrades or fresh server deployments.
- Operators must rotate user keys, funding-source macaroons, and integration secrets across services like LNDHub and NWC Provider.

## Editorial remark

- **Context:** LNbits acts as an accounting and liquidity layer built atop Lightning Network backends, making its hot wallet instances prime targets for automated exploit attempts when software vulnerabilities emerge.
- **Impact:** Node operators, self-hosted custodial platforms, and end users relying on connected applications like Bolt Cards and LNDHub face potential loss of funds if instances remain unpatched and keys are unrotated.
- **Watch:** Publication of the comprehensive LNbits post-incident report detailing the attack vector, alongside patch adoption metrics across node monitoring indices.

Lightning Network accounting platform LNbits issued an urgent security release on Nov. 10, 2026, directing all node operators to upgrade to version 1.7.0 following an exploit identified on Nov. 8 [1]. The software maintainers warned that all releases prior to version 1.7.0 harbor vulnerabilities that place hosted funds at direct risk of theft [1].

According to the development team, simply patching existing instances may be inadequate if unauthorized access occurred before the update [1]. In an official advisory, LNbits advised node administrators who suspect a breach to deploy version 1.7.0 on an entirely fresh server, preserve diagnostic logs, and execute a full credential reset [1]. Super administrators must rotate all user wallet keys, revoke and reissue funding-source credentials such as API keys and Lightning Network macaroons, and cycle system secrets [1]. Integrated extensions—including LNDHub, Nostr Wallet Connect (NWC) Provider, Bolt Cards, TPOS, Bleskomat, and FOSSA—require revoked connections and newly issued authorization tokens [1].

## Hot Wallet Safeguards and Incident Review

The vulnerability emphasizes the persistent counterparty and technical risks tied to hot wallet management across layer-2 infrastructure. Similar infrastructure challenges have surfaced elsewhere in the Bitcoin ecosystem, such as when [BTCPay Server released an emergency patch following an exploited LND vulnerability](https://basisdesk.news/news/btcpay-server-patches-exploited-lnd-vulnerability). LNbits reiterated that because hot wallets maintain spending credentials on live, internet-facing servers, operators should limit balances to day-to-day liquidity needs and route reserve capital to offline cold storage [1]. At the time of writing, $BTC traded around $73,416.

LNbits stated that comprehensive details explaining the mechanics of the exploit will be disclosed in a forthcoming post-incident report [1].

## Sources

1. [LNbits 1.7.0: security update and upgrade guidance](https://news.lnbits.com/news/lnbits-1-7-0-security-update) — news.lnbits.com, 2026-11-10

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai