LNbits, the open-source Lightning Network wallet and payments platform, told operators on Nov. 8 to take all servers offline immediately after multiple reported security compromises. The project said critical patches were being prepared as attacks were still unfolding.

The warning marked an escalation from an earlier alert the same day, when LNbits had asked operators using its Paywall extension to disable that feature while developers investigated a possible flaw. A later shutdown notice indicated the issue may not have been limited to a single extension.

Urgent shutdown notice issued

According to the project’s public updates, the first warning appeared at about 12:33 UTC, when LNbits said operators should disable the Paywall extension immediately. At roughly 13:56 UTC, LNbits followed with a far more urgent message calling for all running instances to be shut down at once.

Core contributor Ben Arc said patches were expected within 24 to 48 hours and urged the community to spread the warning to anyone running LNbits infrastructure. LNbits also suspended instances on its hosted service, my.lnbits.com, and said operations there could resume within about 24 hours after fixes were in place.

Known theft on a Bittipbot-linked instance

One publicly documented case involved Dutch operator Kevin Ravensberg, whose LNbits deployment supports Bittipbot, a tipping service on Telegram. Ravensberg said attackers created new accounts and withdrew 2,285,545 satoshis between 9:22 a.m. and 2 p.m. UTC on Nov. 8.

That amount is approximately 0.02285545 BTC. Ravensberg said affected Bittipbot users would be reimbursed personally, but access to funds would remain limited until LNbits developers addressed the security problems.

Cause of the exploit remains unclear

At the time of the warning, investigators had not publicly identified the exact method used to carry out the unauthorized withdrawals. The incident nonetheless raised questions around LNbits account management and authorization controls, especially for instances exposed to the public internet.

LNbits is designed as a modular payments system that connects to Lightning funding sources such as LND and Core Lightning. It supports separate wallets, APIs, payment terminals, tipping services and a range of extensions, a flexible design that also increases the number of components requiring security review and maintenance.

Part of a broader year of Lightning security issues

The LNbits emergency came after several other Lightning-related security problems in 2026. Earlier in the year, vulnerabilities were reported across Core Lightning, Lightning Development Kit and Eclair, prompting patches and, in some cases, temporary precautions by operators.

In August, Core Lightning maintainers dealt with a wave of AI-assisted vulnerability reports, including several genuine issues, and emergency measures were advised while fixes were prepared. Reports at the time said about 22% of Core Lightning nodes went offline during that disruption. Later security releases in September and October addressed denial-of-service risks, channel-closing weaknesses, transaction-signing issues and potential fund-loss scenarios.

What happens next

LNbits had already been reviewed earlier in 2026, when an external audit found an authentication-cache bypass and a Paypal integration weakness that were reportedly fixed in version 1.6.0. No connection had been established between those earlier defects and the Nov. 8 attacks.

For now, the confirmed guidance from LNbits is for operators to keep affected systems offline until patches are released and verified. The next step is expected to be the publication of fixes, followed by a controlled restoration of services once developers determine which components were compromised and how to prevent further unauthorized withdrawals.

Source: news.bitcoin.com