1 hour ago
4
Key Takeaways
- 1.7.1 rotates the login signing key only
- Wallet keys and backend credentials need manual rotation
- LND macaroons survive deletion until root key changes
- Rotate from a fresh server, backend first
The warning is LNbits’ own: its November 10 security notice says credentials exposed before the upgrade may still give an attacker access afterwards.
The vulnerability was found on November 8. LNbits’ first public instruction that day was to disable the Paywall extension; within hours it told operators to shut their servers down entirely and took its own hosted instances offline. Version 1.7.0 followed on November 10, and the notice says every earlier version is affected and funds on them are at risk. Creator Ben Arc has said both the project and its users lost money. LNbits has promised a separate report on how the exploit worked, so the mechanism is still undisclosed, and nothing below should be read as describing it.
...
English (US)