LNbits Releases 1.7.0 Security Update, Warns All Older Versions Are Affected

LNbits released version 1.7.0 to address a vulnerability affecting every earlier version, warning that installing the update alone may not protect wallets if credentials have already been exposed.

The open-source Bitcoin (BTC) wallet and payments platform for the Lightning Network urged all operators to install the update immediately. LNbits also recommends resetting wallet keys and replacing related credentials if they may have been exposed. Operators who suspect an instance was compromised are urged to migrate the server. The warning covers every version released before 1.7.0.

The update addresses the vulnerable software, but not credentials that were already leaked. LNbits’ guidance separates installing the fix from responding to possible exposure: key resets and credential replacement address exposed credentials, while server migration is recommended when compromise is suspected.

A user reported that an attacker used an LNbits instance to create a new account and steal about 0.023 BTC. Losses have affected both users and the LNbits team, which is working on a response.