LNbits, software behind many Bitcoin Lightning wallets, ships an emergency fix after funds were stolen

LNbits is free software that powers many small Bitcoin Lightning wallets and payment tools. Over the weekend its team told everyone running it to switch it off because of attacks, and on Tuesday it shipped a fix. Here's what happened, who it touches, and what to do if your sats sit in an app built on it.

What happened

• Sunday morning, November 8 (7:33 AM ET): LNbits asked everyone running it to switch off its Paywall extension straight away while it looked into a possible bug.
• About 80 minutes later (8:56 AM ET): it widened the warning. All LNbits users "should stop their LNbits servers IMMEDIATELY," the project posted, saying it had security patches to push "following a wave of attacks."
• Shortly after noon (12:18 PM ET): LNbits switched off every server on its own hosted service, my.lnbits.com, as a precaution and said services would resume within 24 hours. As of the morning of November 11, LNbits hadn't publicly confirmed that hosted servers were back online or running the fix, so hosted customers should check with LNbits before adding funds.
• Tuesday, November 10 (around noon ET): LNbits published version 1.7.0 on GitHub, calling it a critical security release, and told everyone to update immediately.

At least one operator was hit before LNbits raised the alarm. Kevin Ravensberg, who runs an LNbits server, posted that new accounts used the flaw to withdraw 2,285,545 satoshis (about 0.023 BTC) between 9:22 and 14:00 UTC (4:22 to 9:00 AM ET) on November 8, before he could stop his server. He said he would cover his users' losses himself. LNbits creator Ben Arc wrote that both "our users and we suffered losses."

What LNbits is, in plain words

The Lightning Network is a faster, cheaper payment layer that sits on top of Bitcoin. LNbits is a free, open-source program that sits on top of a Lightning node or another funding source. With it, the person running the server can create wallets for many users and add payment tools on top, such as shop checkouts, tipping services, paywalls and Bolt Cards. Cointelegraph reports that, by Ben Arc's own count in May, roughly 200,000 people run it themselves; that figure hasn't been independently checked.

The important part for regular users: when you hold sats in a wallet someone else runs on LNbits, that operator holds the keys. LNbits itself calls these hot wallets, meaning the credentials needed to spend the money sit on a computer that's online.

What LNbits says now

• Every version before 1.7.0 is affected. LNbits says funds on older versions are at risk of theft, and that operators must upgrade before running LNbits again.
• Updating isn't enough on its own. Keys or passwords exposed before the upgrade could still let an attacker in afterwards. So LNbits tells operators to reset all users' wallet keys, replace the credentials for their funding source, treat other secrets in the settings as compromised, and rebuild connections made through extensions (LNbits lists NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA). If a break-in is suspected, it recommends starting over on a fresh server and keeping the logs.
• The details are still to come. LNbits hasn't said how the attack worked or how many servers were hit. It says a separate report on the exploit will follow.

It's the second such warning for self-hosted bitcoin payment software this month. On November 1, BTCPay Server told its operators to shut down after hot wallets were drained on older versions.

What this means for you

• If you use a Lightning wallet, tipping bot, Bolt Card or shop checkout that someone else runs: you can't install the fix yourself. If you know or suspect the service uses LNbits, ask the operator whether it has moved to 1.7.0 and reset keys, and keep only spending money there. Expect some disruption: after a key reset, old wallet links, connected apps and Bolt Cards stop working until you get new details, and some services have paused withdrawals until they patch. Get new keys only through the service's official site or app, never from someone who messages you first.
• If you run LNbits: don't restart an old version. Follow LNbits' upgrade guide in full, including the key resets, and check your balances and outgoing payments for anything you don't recognize.
• For everyone: LNbits' own advice applies to any always-online wallet. Keep only what you need for day-to-day spending online, and move savings to a wallet whose keys stay offline. Our guide to crypto wallets explains the difference.

The takeaway

This was a security problem in one widely used piece of Lightning software, not in Bitcoin or the Lightning Network; LNbits hasn't yet said whether one flaw or several were involved. A fix is out, but it only helps once each operator installs it and changes its keys. Until LNbits publishes its full report, treat any balance on an LNbits-based service as at risk and keep it small. This is education, not financial advice, and reflects what was public on the morning of November 11, 2026.

Published November 11, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio