The risk falls on operators running their own LNbits servers and on anyone holding a balance on someone else’s instance. People who keep bitcoin only on exchanges or in standard wallet apps are not exposed. One documented victim lost 2.28 million sats, roughly 0.023 bitcoin or $1,700 at current prices. LNbits has not published a total for losses across all instances. Founder Ben Arc called it a very challenging few days
as the team raced to finish the patch while both users and the project itself took losses.
The release notes describe LNbits 1.7.0 as a critical security update with extensive hardening, covering login, extension management, and payment processing. It also adds two-factor authentication, on-chain wallets, BOLT12, and NIP-17 support. What it does not yet include is a technical explanation of the exploit itself. LNbits says a separate report will follow.
Why the Upgrade Alone Does Not Close the Door
LNbits is a hot wallet that sits on top of a Lightning funding source and splits it into sub-accounts. It does not hold on-chain private keys directly, but it does store credentials for the funding source and keys for each individual wallet. That is the real exposure. As LNbits put it, credentials exposed before the upgrade may still give an attacker access afterwards.
So patching is step one of several, and it follows other recent wallet flaws under active exploitation. The project’s guidance for operators comes down to a short checklist:
- Reset all user wallet keys
- Revoke or delete existing extension connections before creating new ones
- Revoke and replace funding-source credentials
- Replace any other stored secrets
Six extensions need their credentials renewed specifically: NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat, and FOSSA. Each has its own authentication path, so rotating a wallet key while leaving an old extension connection active keeps a side door open for an attacker. For mandatory steps like these, order matters: revoke first, then recreate.
If you suspect a compromise, LNbits recommends keeping the logs and records from the old server, then replacing it with a fresh server running 1.7.0. Operators without the infrastructure to manage that can take the simpler route of holding bitcoin on a licensed exchange or in a well-maintained software wallet. The project also advises keeping only operating funds on the server and moving reserves to an offline-secured wallet. With around 200,000 operators running LNbits worldwide, the cleanup is a heavy lift for the Lightning ecosystem.
Hashlytics Take
The detail that matters is not the patch, it is the recovery. LNbits only works because the server holds live credentials, so a bug that exposes them turns every installed instance into a rotation job, and an upgrade does nothing for secrets an attacker already copied. Anyone who updated on November 10 and stopped there should assume they are still exposed. It is also a reminder that running a hot wallet for other people is a custody business, whatever the software calls itself, and the safest balance on one is the smallest you can get away with.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
