LNbits, an open-source system for managing Bitcoin Lightning wallets and payment apps, has told every operator to shut down their servers after what the project called a wave of attacks. The emergency notice, posted on November 8, says developers have security fixes to prepare and asked operators to keep their instances offline in the meantime.
In its official shutdown notice, LNbits told all users to stop their servers immediately. The project also switched off the instances it runs through my.lnbits.com and said the hosted service would be restored within 24 hours, a target of about 17:20 UTC on November 9. The target had passed by the time of this review, but the public service page did not show a readable restoration notice. Developer Ben Arc said in a patch estimate that fixes should be merged and available within 24 to 48 hours. The warning applies to LNbits servers, not to the underlying Lightning nodes or other wallet software.
One operator reported a quantified loss from the attacks. Kevin Ravensberg, who runs the BitTipBot Telegram tipping service, said attackers created new accounts on his LNbits instance and withdrew 2,285,545 satoshis, or about 0.023 bitcoin, between 09:22 and 14:00 UTC on November 8. His incident post describes the withdrawals, while The Hacker News’ original report documents the wider shutdown and the operator’s account. LNbits has not disclosed a total loss across its deployments.
The project first warned operators using its Paywall extension to disable it while a possible bug was investigated. About 80 minutes later, it widened the warning to every LNbits server. Ravensberg later said LNbits developers and security testers had confirmed which extension was exploited on his instance, but they had not publicly named it or confirmed that it was Paywall. The public notices have not identified the affected software versions or named the underlying flaw.
The LNbits GitHub releases page still lists v1.6.2, released on September 18, as the latest stable version; it does not list an incident-specific fix. The project has not published a CVE identifier or an affected-version range for the current incident.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
