As reported by Deep Tide TechFlow on November 11, 2026, at 09:31 (UTC+8), LNbits released version 1.7.0 as a security update and said operators should upgrade before running their services.
According to the project, a vulnerability discovered on November 8 affects all earlier versions, putting funds in those versions at risk of theft. LNbits warned that upgrading alone may not remove an attacker’s access if credentials were exposed beforehand.
LNbits advised operators to reset all wallet keys, change funding sources and replace other sensitive credentials. If a server may have been compromised, it recommended installing the new version on a new server and preserving the relevant logs.