LNbits Tells All Operators to Shut Down Servers After Wave of Attacks Drains Funds

Published November 9, 2026, 4:25 AM PKT. Based on reporting from Bitcoin.com (primary source), Crypto Briefing, CryptoNews, TFTC and KuCoin, plus the official LNbits posts on X.

LNbits, the open-source wallet and accounts platform for the Bitcoin ($BTC) Lightning Network, told every server operator to stop their servers immediately on November 8, 2026, after a wave of attacks let intruders create unauthorized accounts and withdraw funds. The project said it had a number of security patches to push and that operators should stay offline until the fixes are ready, a shutdown order that covers every self-hosted instance and the project's own hosted service.

The warning arrived at about 13:56 UTC on November 8, when the official LNbits account on X posted: "All LNbits users should stop their LNbits servers IMMEDIATELY. Please forward this announcement. Following a wave of attacks, we have a number of security patches to push. Until then, it's better to err on the side of caution. Updates to follow soon." LNbits also disabled all instances on its hosted service, my.lnbits.com, as a precaution, and developers said that service could resume within about 24 hours once the fixes are in place.

The Paywall warning that came first

The first sign of trouble came about 80 minutes before the full shutdown order. At about 12:33 UTC on November 8, LNbits advised operators using its Paywall extension to disable the feature immediately while developers investigated a potential vulnerability. The later shutdown instruction covered all LNbits servers, not only installations using that extension, and it did not exempt any funding-source configuration.

The notice did not identify which versions are vulnerable, explain how the attackers got in, or state a total loss figure. At publication, the project's GitHub releases page still listed v1.6.2, a PostgreSQL backup hotfix released on September 18, as its latest release, with no build addressing the November 8 attacks. LNbits had already been through a security review earlier in 2026: an external audit by V12 identified an authentication-cache bypass and a PayPal integration weakness, both reported as fixed in version 1.6.0. No connection has been established between those earlier defects and the November 8 attacks.

The Bittipbot drain: 2,285,545 sats

The clearest confirmed loss came from Dutch operator Kevin Ravensberg, whose LNbits instance supports Bittipbot, a Telegram-based tipping service. Ravensberg said attackers created new accounts on his instance and withdrew 2,285,545 satoshis between 9:22 a.m. and 2 p.m. UTC on November 8, a window of roughly five hours. The amount equals about 0.02285545 Bitcoin ($BTC), worth roughly $1,730 at Bitcoin's ($BTC) price near $75,800.

Ravensberg said he would personally reimburse the affected Bittipbot users, but he also said the funds remain inaccessible until LNbits ships its patches, so users are waiting on the project before they can be made whole. His figure is one operator's self-reported loss for his own instance, not a global total for the incident, and no other operator has publicly put a number on what was taken.

Patches in 24 to 48 hours

Core contributor Ben Arc reinforced the shutdown order and said the patches should be merged and available within 24 to 48 hours of the warning. That is an estimate, not a release notice or a safe-restart deadline, and no official post has yet cleared operators to restart their servers.

The shutdown is a consequence of how LNbits is built. The software is self-hosted, so there is no central switch the project can flip to protect every instance. Each operator runs a server on their own machine, which means each one has to hear the warning and act on it individually. The project asked the community to spread the advisory as widely as possible.

The incident is confined to LNbits software, not the Bitcoin ($BTC) base chain or the Lightning Network protocol itself. Other Lightning projects, including Core Lightning, Lightning Development Kit and Eclair, have faced their own vulnerabilities during 2026, and developers patched a reconnect flaw in Lightning Development Kit that could have induced affected nodes to sign conflicting commitment transactions. No specific link has been confirmed between those updates and the LNbits vulnerabilities.

What is still unknown

Four questions remain open. The first is the attack route: LNbits has not disclosed how attackers created the unauthorized accounts or moved the funds, and the details have been withheld while patches are prepared, so operators cannot yet judge whether their own setup was exposed. The second is the scale: no total loss figure, victim count or list of affected instances has been published, and the only confirmed number is the 2,285,545 satoshis from Bittipbot. The third is the patch itself: no fixed version has been released, no CVE has been assigned, and the public security advisory page still shows older 2024 and 2025 entries rather than one for this incident. The fourth is the restart: the hosted service is suspended and self-hosted operators have no confirmed date for bringing servers back online.

Until the patches ship, the instruction stands. Operators should keep their LNbits servers offline, and anyone holding funds in an LNbits-backed service should assume no access until the patch is released and the operator confirms the instance is clean.

Sources

• LNbits, official X account (@lnbits), November 8, 2026 (primary source: "All LNbits users should stop their LNbits servers IMMEDIATELY. Please forward this announcement. Following a wave of attacks, we have a number of security patches to push."; earlier Paywall extension warning at about 12:33 UTC)
• Ben Arc, LNbits core contributor, X post, November 8, 2026 (primary source: patches "should be merged and available within 24-48hrs")
• Kevin Ravensberg (@KevinR4v), Bittipbot operator, X post, November 8, 2026 (primary source: 2,285,545 satoshis withdrawn by newly created accounts between 9:22 a.m. and 2 p.m. UTC; personal reimbursement pledge; funds inaccessible until patched)
• Bitcoin.com, Lightning Network Security Scare Forces LNbits Servers Offline, November 8, 2026 (secondary reporting: warning at about 13:56 UTC; my.lnbits.com suspended with resumption within 24 hours of fixes; Ravensberg 2,285,545 satoshis, about 0.02285545 Bitcoin ($BTC); V12 audit and v1.6.0 fixes; Core Lightning, Lightning Development Kit and Eclair vulnerabilities during 2026)
• Crypto Briefing, LNbits urges users to shut down servers amid wave of attacks, November 8, 2026 (secondary reporting: attackers creating fresh accounts and withdrawing funds; Bittipbot attack window about five hours; reimbursement pledge; patch timeline 24 to 48 hours; no central switch for self-hosted instances)
• CryptoNews, LNbits Urges All Server Operators to Shut Down After Attacks, November 8, 2026 (secondary reporting: post at 8:56 a.m. ET; hosted instances disabled; GitHub latest release still v1.6.2, September 18 PostgreSQL backup hotfix; no vulnerable versions identified, no total loss stated)
• TFTC, LNbits Emergency Shutdown: Active Attacks Drain Funds, November 8, 2026 (secondary reporting: Paywall warning about 80 minutes before the systemwide shutdown; Lightning Development Kit reconnect vulnerability; hosted service suspended until patches ship)

This article is news reporting and is not investment advice.