LNbits has reportedly urged operators to upgrade to version 1.7.0 after attacks on server instances allegedly resulted in stolen funds. It warned that all versions released before 1.7.0 place user funds at risk. The reported guidance also said that an update alone may not be sufficient if an instance has already been compromised.

Which LNbits versions were reportedly at risk

The report says LNbits issued a broad warning that every version before 1.7.0 could put user funds at risk. This means the reported cutoff applies to the software version itself, rather than to one minor build or a narrowly defined extension.

This is significant because the same report described the update as an emergency response to attacks that resulted in stolen funds. For operators assessing the urgency, the practical takeaway is that the reported risk period covers legacy LNbits deployments generally, not merely a clearly confirmed subset. However, the exact exploit path and the precise scope of the fix have not been verified here through an official release note or advisory.

Why updating may not be enough after compromise

The reported guidance extended beyond installing version 1.7.0. LNbits was said to have first warned operators to disable the Paywall plugin, then instructed users to shut down servers, while taking hosted servers offline as well.

As part of the same reported response, LNbits warned that updating alone would not fully resolve the issue if user information had already been compromised. Operators were also advised to reset wallet keys and change sensitive information, underscoring that the patch is only one element of a broader cleanup process after a potential intrusion.

The report also said LNbits plans to publish a detailed exploit write-up. Until then, the distinction is straightforward: version 1.7.0 was presented as the immediate patch point, but operators previously exposed to risk may still need to take further action because a software upgrade does not automatically reverse an earlier compromise.

Reported containment steps and follow-up

According to the current report's account of the incident, the emergency response escalated in stages before or alongside the patch notice. That sequence helps explain why the update was presented with unusual urgency.

What remains unresolved is the precise mechanism behind the attacks and whether exposure varied by hosting model, plugin usage, or server configuration. These details are important for a full recovery plan, but they were not established in the material supporting the current report.