LNbits Attack: Operators Told to Shut Down Bitcoin Lightning Wallet Servers, What Is Confirmed and What to Do Before Restarting
LNbits told everyone running its Bitcoin Lightning wallet server to stop it immediately after a wave of attacks. One operator reports 2,285,545 sats withdrawn. Here is what is confirmed and what to do.
Where Worldwide
On this page 7 sections
LNbits, a free, open-source Bitcoin Lightning wallet server, told everyone running it on Sunday, November 8, 2026, to stop their servers immediately because of a wave of attacks. If your business takes Lightning payments through LNbits, or relies on a vendor that does, treat this as a live incident: one operator says money has already been withdrawn, and no fix was published when we checked on November 9.
This post separates what the LNbits project has said from what one operator has reported, and lists what to do before anyone turns a server back on.
What happened in the LNbits attack
LNbits describes itself as "a lightweight Python server that sits on top of your Lightning funding source." It provides separate wallets, an API and add-on extensions, and it can be hosted by the project, run on an LNbits Box, or self-hosted.
The timeline below comes from the posts made on X by the people involved, all on November 8, in UTC:
| Time | Who | What was said |
|---|---|---|
| 12:33 | LNbits | Anyone with the Paywall extension enabled should disable it while the team investigates a potential bug |
| 13:56 | LNbits | All LNbits users should stop their servers immediately; security patches are being prepared |
| 13:59 | Developer Ben Arc | Patches should be merged and available within 24 to 48 hours |
| 15:29 | Operator Kevin Ravensberg | His instance was exploited before the announcement and 2,285,545 sats were withdrawn |
| 17:18 | LNbits | All instances on its hosted service, my.lnbits.com, were disabled as a precaution, with services to resume within 24 hours |
| 17:47 | Kevin Ravensberg | Arc and a red team confirmed which extension exploit was used on his server, without naming it |
Paywall is an LNbits add-on that hides a link or file until a visitor pays.
What is confirmed and what is only claimed
Stated by the LNbits project: attacks are under way, every operator should stop their server, security patches are coming, Paywall should be disabled, and the hosted service has been switched off as a precaution.
Reported by one operator and not independently verified: Ravensberg says new accounts used an exploit to withdraw 2,285,545 sats, about 0.023 BTC, from lnbits.btip.nl between 09:22 and 14:00 UTC. That start time is more than three hours before the first public warning. He says users of BitTipBot, a Telegram bot that uses the instance, cannot reach their funds until the flaws are fixed, and he has promised to make them whole.
Not known as of November 9:
- Which flaw or extension was used, and whether it was Paywall
- Which LNbits versions are affected
- How many servers were attacked and how much was taken in total
- Whether any funding source credentials were exposed
- How an operator can confirm whether a server was hit
We found no CVE for this incident. The LNbits GitHub advisories page listed only two older advisories, from June 2024 and April 2025.
Is there an LNbits patch yet?
Not that we could find on November 9. The newest tags in the official repository were v1.7.0-rc1 and v1.7.0-rc2, both dated October 29, the latest full release on the releases page was v1.6.2 from September 18, and the newest commit on the dev branch was dated November 6. All of those predate the attacks, so do not treat any of them as a fix.
Arc's estimate runs to about 14:00 UTC on November 10, so this may change quickly. Check the official repository before acting. The LNbits security policy says fixes go to the current release and the dev branch, and that older releases and release candidates are unsupported, so plan to move to the new release.
What to do this week if you run LNbits
Stopping the server is the project's instruction. The other steps are our advice, because LNbits had not published a cleanup guide when we checked.
| Action | How to do it or check it |
|---|---|
| Stop every LNbits server | Include test copies and forgotten installs, then confirm each web address no longer answers |
| Preserve evidence | Copy logs and the database off the server before any upgrade or reinstall |
| Look for unexplained activity | Search for new accounts and outgoing payments, including before November 8 |
| Review your funding source | Stopping LNbits does not stop the Lightning node or wallet behind it, so check its own payment history |
| Replace credentials if anything looks wrong | Issue new keys for the connection between LNbits and the funding source; no report says keys were stolen, so this is a precaution |
| Get the fix from the official source | Use only the lnbits/lnbits GitHub repository and ignore patch links sent by direct message |
| Tell the people affected | Warn customers that payments are paused and record any losses for your accounting team |
When a fixed release is out, consider restarting with less exposed. The LNbits example configuration file documents LNBITS_ALLOW_NEW_ACCOUNTS=false, which turns off account creation, and LNBITS_EXTENSIONS_DEACTIVATE_ALL=true, which starts the core without extensions. The same file warns that with LNBITS_ADMIN_UI=true most file settings are ignored, so confirm in the running system that a change took effect. LNbits has not said these settings block this attack, so they do not replace the patch or the shutdown.
If you use my.lnbits.com, the project has already disabled it and you should wait for its all-clear. If a vendor runs LNbits for you, ask them today whether their server is off and whether any funds moved.
Why the LNbits shutdown matters for a business
Lightning payments generally cannot be pulled back once they settle, and there is no card network to dispute them with. A payment server connected to a funded wallet is closer to a cash drawer than to a website, so a flaw in it can become a direct loss.
The response also has a cost. Stopping the server means no checkout, tips or customer withdrawals until the fix lands. Businesses that self-host payment tools need a way to keep operating during that gap and a person with authority to pull the plug. Our self-hosting infrastructure page covers what running your own systems involves.
LNbits attack questions people are asking
Should I shut down my LNbits server?
Yes. The project told all LNbits users to stop their servers immediately, and we found no withdrawal of that notice.
Is Bitcoin or the Lightning Network hacked?
Nothing we read says so. The notices are about LNbits servers.
Was the Paywall extension the cause?
That is not confirmed. Paywall was named in the first warning, but the project then widened its notice to all servers, and the extension used against the one reported victim has not been named publicly.
How much money was stolen in the LNbits attack?
The only figure we could trace is one operator's report of 2,285,545 sats. LNbits has not published a total.
Is there a CVE for the LNbits vulnerability?
We found none as of November 9, and no new GitHub advisory.
How do I know if my LNbits server was hacked?
No official method had been published when we checked. Review new accounts and outgoing payments, and keep your logs for when details are released.
The bigger lesson
By one operator's account, the theft began more than three hours before any public warning, and the warning came on a Sunday. Applying patches quickly would not have closed that gap. If software you run can move money, limit the balance it can reach, watch its outgoing payments, and decide ahead of time who can turn it off.
If you want a second set of eyes on a payment server or self-hosted system, see our security hardening work or request a quote.
Get security alerts like this by email, along with our free checklist.
Sources: LNbits shutdown notice; LNbits Paywall warning; LNbits hosted service notice; Ben Arc patch estimate; Kevin Ravensberg loss report; Kevin Ravensberg follow-up; LNbits GitHub tags; LNbits releases; LNbits dev branch commits; LNbits security advisories; LNbits security policy; LNbits README; LNbits example configuration; LNbits Paywall extension; LNbits.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
NotC2 AWS Bedrock C2: Researchers Turn Stolen Cloud Credentials Into a Hidden AI Control Channel, and What to Check This Week
Varonis built NotC2, a proof of concept that uses AWS services and Bedrock AI as a hidden control channel afte...
ModSecurity Vulnerability CVE-2026-104269: File Uploads Can Slip Past WAF Rules, Three Flaws Rated High, and the Fixed Versions to Install
ModSecurity published eight security advisories on September 30, 2026, three rated High, including a file uplo...
Binance Hack: How a Fake Job Interview Helped Start a $6.3 Billion Crypto Theft, What Is Confirmed and What Businesses Should Change
Binance says about $6.34 billion was stolen after a fake job interview gave attackers a foothold on a work com...
