Originally reported November 11, 2026, at 09:28 (UTC+8). ChainCatcher, citing Cointelegraph, reported that LNbits released version 1.7.0 after a wave of attacks that led to stolen funds. LNbits urged users to update and warned that the vulnerability affects all earlier versions.
An update alone will not protect users whose credentials have already been exposed, LNbits said. It advised users to reset wallet keys and replace related credentials, and to move servers if they suspect a compromise.
LNbits founder Ben Arc said the team was working to respond after users and the team suffered losses. One user reported that an attacker created new accounts on their LNbits instance and stole about 0.023 BTC.