LNbits Tells Every Operator to Shut Down Its Server While It Prepares Fixes. One Operator Lost About 0.023 BTC Before the Warning, and No Patched Version Exists Yet
If you run an LNbits server, the project's advice as of this morning is to shut it down until fixes are released. If you cannot shut it down, take the Paywall extension off first, because that was the project's first warning, and do not add funds to the server. If you use someone else's LNbits server, such as a tipping bot or a hosted wallet, withdraw what you can once it is back and do not top it up until the operator says it is patched.
What has been reported
Everything below comes from one report. The Hacker News published it on November 9, 2026 and describes posts by the LNbits project and by an affected operator on X. We could not read those posts.
- The project told operators to shut down their LNbits servers because of a wave of attacks. It said it has several security fixes to release and asked operators to be careful until they are out.
- The narrower warning came first, at about 12:33 UTC on Sunday, November 8: operators using Paywall, an add-on that makes people pay to view content, were asked to disable it while the project looked into a possible bug. The shutdown notice followed at about 13:56 UTC, roughly 80 minutes later. Its wording, as reported by Bitcoin.com: "All LNbits users should stop their LNbits servers IMMEDIATELY. Please forward this announcement."
- As of 09:00 UTC on November 9, no fixed version had been released. A developer said patches "should be merged and available within 24-48hrs" from his post the day before.
- The project also switched off the LNbits instances it runs for users on its cloud service, my.lnbits.com, and said service would return within 24 hours.
The one loss we know of
One operator, Kevin Ravensberg, reported that new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server. By the report's account, the attack ran from 09:22 to 14:00 UTC on November 8, starting more than three hours before the project's first warning at 12:33 UTC. He has promised to repay the users of BitTipBot, a Telegram bot, who cannot reach their funds until the flaws are fixed.
He later said the project's developers and a team of testers confirmed "which exact extension exploit was used" on his server. Neither he nor the project had named the extension as of the report, and the project had not said whether it is Paywall.
What we do not know
- Which extension is exploited, and whether Paywall is the one.
- How many servers were attacked or how much was taken in total. The only figure is the one operator's.
- Whether the flaw can be exploited without any extension installed.
- Whether disabling Paywall is enough. The project has not offered that as an alternative to shutdown, and has not canceled the shutdown notice.
- How to check whether your server was already hit. The project had not said.
- Whether there is a CVE. We found none, and the LNbits GitHub advisory page lists only two older advisories, from 2024 and 2025.
The shutdown notice covers LNbits servers. It does not mention Lightning nodes or other wallet software, so do not treat this as a warning about other products.
What to do
- Stop the server, or at minimum remove extensions you do not need, starting with Paywall.
- Do not add funds to an LNbits wallet until a fixed version is announced by the project itself.
- If you ran a server during November 8, review withdrawals and new accounts for that day. Look for accounts created just before large withdrawals. This is our inference from the one reported attack, not guidance from the project.
- Watch the project's official channels for the fixed release. Be wary of messages offering "recovery" or links to patched builds from anyone else.
- If you are a user of a bot or service built on LNbits, ask the operator whether it was running and when it was stopped.
How we know, and how we checked
We read The Hacker News report and a second report from Crypto Briefing, which agrees on the shutdown request, the 2,285,545 satoshi loss and the 24 to 48 hour patch estimate. The three reports appear to draw on the same posts on X, so treat them as one source, not three. A third report, from Bitcoin.com, adds the 12:33 and 13:56 UTC times and the quoted wording, and also agrees on the loss and the patch estimate. Crypto Briefing does not mention the Paywall warning, and none of the three names the exploited extension. Crypto Briefing and Bitcoin.com both say an earlier outside review of LNbits (by V12) found an authentication-cache bypass and a PayPal integration weakness, reportedly fixed in version 1.6.0; neither establishes any link to this weekend's attacks, and they disagree on whether it was in September, so we give no month. Crypto Briefing adds that no link has been confirmed to security updates released by Electrum and Core Lightning in early November. We also checked the LNbits GitHub releases page, whose newest release was dated September 18 with no security fix noted. That page may lag, so it is not proof that no fix exists. We have no indicators to add to our feed: the report publishes no addresses, hashes or request patterns.
Sources
The Hacker News, "LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks," November 9, 2026. Crypto Briefing, "LNbits urges users to shut down servers." Bitcoin.com, "Lightning Network security scare forces LNbits servers offline." LNbits GitHub releases and security advisories pages.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Audit your site now → aipmsec.com
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. The question lives here: https://analytics.dugganusa.com/nps.html#post=lnbits-shut-down-servers-extension-exploit