The open-source Lightning wallet and accounts server published LNbits 1.7.0 with security fixes after a vulnerability discovered on November 8. The team told all operators to upgrade before running LNbits again.

Every version prior to 1.7.0 is affected, and funds held on older instances are at risk of being stolen.

Upgrading alone is not enough: credentials exposed before the patch may still give an attacker access. LNbits advises a fresh server if compromise is suspected, a reset of all user wallet keys, new funding-source credentials and fresh connections for extensions such as NWC Provider, LNDHub, Bolt Cards and TPOS.

A full report on the exploit will follow separately. The team also reminded operators that LNbits is a hot wallet and urged them to keep only day-to-day funds online.