LNbits Shipped One Emergency Patch and Gave Every Operator a Second Job

LNbits pushed an emergency patch after users reported Bitcoin wallets getting drained, then did the thing almost nobody in crypto does. It told operators that upgrading wasn't enough.

That second sentence is the whole story. The rest is bookkeeping.

Because a patch closes the door. It doesn't un-walk the burglar. And in a self-hosted Lightning setup, the burglar may have been sitting in the house for weeks before anyone noticed the door was open.

The Order of Events

The reports came first. Balances missing. Withdrawals nobody authorized. Users of self-hosted LNbits instances comparing notes in the usual places, half of them convinced they'd fat-fingered something and half of them already knowing better.

Then the project moved. An emergency patch, issued fast, with a warning stapled to the front of it. Installations running older versions were vulnerable. If you were on one of them, assume the worst.

And then the instruction that matters more than the code change: replace any credentials that might have been exposed, even after you upgrade.

Naturally, that's the line everyone will skim past.

Think about what it actually asks. Upgrading is a chore you can automate. Rotating keys, passwords, API tokens, and connection strings across a live Lightning node is surgery. You do it at 1am with a mug of tea going cold and your fingers crossed that the channels stay open and nothing force-closes while you're rebooting.

The number of operators who complete step two is always smaller than the number who complete step one. Not because they're lazy. Because step two is scary, thinly documented in places, and there's no undo button. One wrong move and you've locked yourself out of your own money. That's a hell of a choice to hand a hobbyist on a Tuesday.

Here's the thing about open source security. Everyone can read the code, and almost nobody does. That's not an insult to open source. It's an insult to the fairy tale we tell about it.

So who's accountable when the software you self-host gets you robbed? The maintainers who shipped a bug, or the operator who never read the changelog?

What Actually Broke

The immediate damage is measured in sats. The lasting damage is measured in optics, and in the fine print of self-custody that nobody reads out loud.

Run the math on where the patch burden lands. A hosted wallet puts it on the host, who has staff and a runbook and a reason to care. A self-hosted install puts it on you, plus the thousands of tinkerers, small merchants, and weekend node runners who chose this route specifically to escape a custodian. They got autonomy. They also got the on-call rotation.

That's the trade, and it's a fair one, but somebody should say it plainly. Not your keys, not your coins has a second half. If they're your keys, the patch is your problem.

I've seen enough self-custody sermons to know the preachers leave that part out.

The phrase "even after upgrading" is an admission that the exposure already happened. Upgrading closes the hole going forward. It doesn't un-leak whatever walked out the back. That's the sentence a regulator will read back to this industry at a hearing, and it'll be quoted with the same tone people use for a recall notice on a car.

Who wins here? Security auditors, mostly. The firms that get paid to sweep an instance, check the tokens, and sign off. Hosted Lightning providers get a free marketing line too. We patch for you. It's not a lie, and it's going to convert.

Who loses? The long tail. The Raspberry Pi in a closet in Lisbon running a build from a year and a half ago, behind a router nobody's touched since installation. That node is still exposed and its owner is reading about this three weeks late, if at all.

And spare me the roadmap that says this gets easier. App-layer Lightning tooling has been treated as a hobby project for years, funded by grants and goodwill, while it holds real money for real merchants. That's the hubris in one sentence. We built payment rails on top of something we fund like a book club.

The Clock Starts Now

Three things to watch, and they've dates attached.

First, a full incident writeup. A timeline, a version floor, and a loss estimate, published within 30 days. Without the loss number, every operator is guessing at their own exposure, and guessing is how people end up not rotating anything.

Second, a hard deprecation notice for the vulnerable versions. Not a nudge in a release note. A loud, blocking, unmissable message in the software itself. If old builds can still talk to the network quietly, they'll.

Third, money. Whoever is funding Lightning app-layer tooling needs to fund a security line item, not a bug bounty that pays out in points. A project holding other people's sats and surviving on donations is a grift waiting to be discovered by someone with worse intentions than a curious researcher.

None of this is exotic. It's just unglamorous, and unglamorous work is the first thing cut when a grant runs dry.

LNbits did the right thing and the hard thing in the same week, which puts it ahead of most of this industry. It shipped the fix and told the truth about the cleanup. That's accountability, and it's rarer than it should be.

But the cleanup is still yours. Check what version you're running. Rotate the credentials. Then walk over to the other five self-hosted services on your network that you haven't patched since the last time something got stolen, and do those too.