Science & Tech · Cybersecurity · 7 hrs ago
LNbits Tells Operators to Shut Down Servers After Attacks
LNbits urged operators to shut down its servers after a wave of attacks on the open-source Bitcoin Lightning wallet system.
The warning applies to LNbits servers, not Lightning nodes or other wallet software.
One operator said an attacker took 2,285,545 satoshis, about 0.023 bitcoin, from his server.
The attack on that server began more than three hours before LNbits issued its first warning, which advised operators to disable the Paywall add-on.
LNbits had not released security fixes by 09:00 UTC, and it had not said which extension was exploited or how operators could check for an attack.
The project also switched off the LNbits services it runs on my.lnbits.com, saying they would return within 24 hours.
A developer estimated patches could be available within 24 to 48 hours, while the affected operator said he would repay BitTipBot users, who cannot access their funds until the flaws are fixed.
LNbits urged all operators to shut down their Bitcoin Lightning wallet servers amid a wave of attacks.
An operator reported that an exploit withdrew 2,285,545 satoshis from his server before he could stop it.
The project first warned operators to disable the Paywall add-on, then issued a broader shutdown notice about 80 minutes later.
As of 09:00 UTC on November 9, the project had not released a fixed version.
The project also switched off the LNbits instances it runs on my.lnbits.com and said services would return within 24 hours.
- Who
- LNbits urged operators of its servers to shut them down. An operator, Kevin Ravensberg, reported a loss.
- What
- The project issued a shutdown notice amid attacks and said it had security fixes to release.
- When
- The warnings were issued on November 8, 2026. As of 09:00 UTC on November 9, no fixed version had been released.
- Where
- On LNbits servers, including the project's my.lnbits.com cloud service.
- Why
- The project said it was responding to a wave of attacks and was preparing security fixes.
This story does not have two clearly opposing sides.
The attack on Ravensberg's server began, according to his loss report.
LNbits issued its first warning, asking operators to disable Paywall while it investigated a possible bug.
LNbits issued a broader notice urging all operators to shut down their servers.
The reported attack on Ravensberg's server ended.
LNbits switched off the instances it runs on my.lnbits.com and said services would return within 24 hours.
- Reported loss
- 2,285,545 satoshis, about 0.023 bitcoin
- First warning
- 12:33 UTC yesterday
- Attack period
- 09:22 to 14:00 UTC yesterday
- Patch estimate
- 24–48 hours
- Hosted service
- my.lnbits.com
1 source
What people are saying
should be merged and available within 24-48hrs.
which exact extension exploit was used
Posts on X
⚠️⚠️ All LNbits users should stop their LNbits servers IMMEDIATELY. ⚠️⚠️ Please forward this announcement. Following a wave of attacks, we have a number of security patches to push. Until then, it's better to err on the side of caution. 🙏 Updates to follow soon.
⚠️ Security precaution for ALL LNbits operators: If you are have the Paywall extension enabled, please disable it IMMEDIATELY, while we investigate a potential bug.
As a precaution we have disabled all instances on our saas https://t.co/F9GznvZL6z. Sorry for any inconvenience. All services will be resumed with 24hrs.