"Very challenging few days." That is how LNbits creator Ben Arc summed up the weekend on X, per CoinTelegraph. His team had just shipped an emergency patch after attackers drained funds from self-hosted Bitcoin Lightning wallets.
The LNbits security update, version 1.7.0, landed on Tuesday, November 10, at 17:09 UTC. GitHub carries it under the label "URGENT SECURITY UPDATE". LNbits tells every operator to install it before running the software again. All versions before 1.7.0 carry the flaw. Funds on those versions sit at risk of theft.
The attacks started on Sunday, November 8. At 12:33 UTC, LNbits told operators to switch off the Paywall extension while the team checked a possible flaw. Eighty-three minutes later, at 13:56 UTC, the project told all operators to shut down their servers at once. Its own hosted service, my.lnbits.com, went offline too. Attackers had been opening fresh accounts on exposed servers and pulling funds out through them. One operator, Kevin Ravensberg, who runs the BitTipBot tipping service, reported 2,285,545 satoshis withdrawn between 09:22 and 14:00 UTC. That window runs 4 hours 38 minutes. The sum is 0.0229 bitcoin: roughly $1,700 at the weekend's prices, per Bitcoin Insider, and about $1,677 at Wednesday's $73,367 bitcoin price from the MarketRadar snapshot. Ravensberg pledged to reimburse affected BitTipBot users from his own pocket.
LNbits is the account layer that sits on top of a Lightning node or funding source. One server can run many separate wallets through it, for merchant checkouts, tipping and paywalls. Roughly 200,000 people self-host the software, Ben Arc said in May, per CoinTelegraph. That spread is why the shutdown order hit so wide: no company server exists to patch in one place, so each operator must act alone. Version 1.7.0 hardens login security, extension controls and payment processing. New in the release: TOTP login codes, on-chain wallets, BOLT12 offers and a superuser key reset, per the GitHub release notes. The project has not yet published how the attackers got in. A separate report on the exploit is still to come.
The theft, in numbers
| Measure | Figure |
|---|---|
| Confirmed theft, one operator | 2,285,545 sats (0.0229 BTC, ~$1,700) |
| Attack window | 09:22-14:00 UTC, Nov 8 (4h 38m) |
| First warning | 12:33 UTC, Nov 8 (switch off Paywall) |
| Shutdown order | 13:56 UTC, Nov 8 |
| Patch release | v1.7.0, Nov 10, 17:09 UTC |
| Shutdown to patch | About 51 hours |
| Self-hosted users | About 200,000 |
| Versions affected | All before 1.7.0 |
Why it matters
The dollar sum is small next to the $388 million Bitget hack in October, per our Bitget coverage. The mechanics cut deeper for self-hosted software. LNbits has no company server to patch in one place. Each of the roughly 200,000 operators must act alone. An update by itself does not close the hole. LNbits warns that credentials exposed before the upgrade can still hand attackers access afterward. Operators must reset wallet keys, swap out funding-source logins and treat stored secrets as compromised, per CoinTelegraph. Anyone who restarts an old version, or updates without rotating keys, keeps the same exposure. Bitcoin itself traded near $73,367 early Wednesday, down 2.03% in 24 hours, after a hot October CPI print on Tuesday. The slide sits apart from the LNbits incident. The attack hit the wallet layer, not the Lightning protocol, a distinction TFTC and Crypto Briefing both draw. Bitcoin's slide to two-month lows came before the patch landed.
What to watch
- The exploit report LNbits promised: which extension or flaw let attackers open accounts
- Whether my.lnbits.com restarts, and what the hosted service changes before it does
- Whether other operators report losses beyond the single confirmed BitTipBot case
- Electrum and Core Lightning pushed fresh security releases in early November, per Crypto Briefing, with no confirmed link to this incident
Key points
- LNbits published emergency patch v1.7.0 on November 10 at 17:09 UTC; all earlier versions carry the flaw
- Attackers opened new accounts on exposed servers and withdrew funds; one operator lost 2,285,545 sats (0.0229 BTC)
- LNbits ordered a full server shutdown on November 8 at 13:56 UTC, 83 minutes after first flagging its Paywall extension
- Updating alone does not clear a compromise: operators must reset wallet keys and replace funding-source credentials
- The flaw sits in LNbits account software, not in Bitcoin or the Lightning protocol
- Roughly 200,000 people self-host LNbits, per creator Ben Arc
MarketRadar take
The patch closes the immediate hole. The 51-hour gap between shutdown and release is the number operators will remember: two days offline for tipping bots and merchant checkouts that run on LNbits. Until the exploit report lands, the safe read is that any server still on a pre-1.7.0 version, or updated without a key rotation, stays exposed. For bitcoin itself the incident reads neutral. The theft touched one software layer. The protocol kept running. The price action this week tracks the CPI print, not the hack.
