LNbits urges operators to shut down servers after attacks

LNbits, the open‑source Bitcoin Lightning wallet system, has urged operators to shut down their LNbits servers after a wave of targeted attacks. One operator reported that an attacker used a flaw in an extension to withdraw 2,285,545 satoshis (about 0.023 bitcoin) before the victim could intervene. The project said it planned security fixes and cautioned operators to remain offline until patches are released.

The shutdown notice followed an initial warning that urged disabling the Paywall add‑on while LNbits investigated a possible bug. As of 09:00 UTC on 9 November 2026, LNbits had not yet released a fixed version, and had not disclosed how many servers were affected or the total theft. Ben Arc, a LNbits developer, indicated that patches should be merged and available within 24–48 hours.

The LNbits team subsequently switched off all LNbits instances it runs on its cloud service, my.lnbits[.]com, with service restoration expected within 24 hours (circa 17:20 UTC today). Kevin Ravensberg, the operator who reported the loss, said his server was compromised during 09:22–14:00 UTC yesterday and has pledged to repay BitTipBot users; funds remain inaccessible until fixes are in place.

Ravensberg later stated that Arc and security testers had confirmed which exact extension exploit was used, though the project had not named the extension publicly by 09:00 UTC.