Operators of LNbits, software for managing Bitcoin (BTC) Lightning wallets and connected services, should upgrade to version 1.7.1, released Nov. 11, after a vulnerability put funds on older installations at risk.
The vulnerability was identified Nov. 8 and affected versions before 1.7.0. LNbits issued version 1.7.0 on Nov. 10 and followed with 1.7.1 a day later. The release notice does not identify which authentication keys changed or say whether operators should still follow the earlier credential-reset steps.
Operators may still need to replace credentials exposed before updating. Administrators are told to replace funding-source credentials and other secrets, change wallet keys, and rebuild certain extension connections. Operators who suspect a compromise are advised to move the installation to a fresh server.
The patch follows the project’s earlier warning for operators to take LNbits servers offline while fixes were prepared.
Operators use LNbits to manage wallets and services connected to a Bitcoin (BTC) Lightning funding source. The project classifies LNbits as a hot wallet and recommends limiting online balances to routine operating funds.
LNbits creator Ben Arc said the incident caused losses for both the team and users, without providing a figure. LNbits plans to publish a separate report detailing how the vulnerability was exploited.
