LNbits Urges All Server Operators to Shut Down After Attacks

LNbits, the open-source Lightning wallet and accounts platform, told all operators to stop their servers immediately on Nov. 8 after what it called “a wave of attacks,” with security patches still pending.

“All LNbits users should stop their LNbits servers IMMEDIATELY,” the project posted on X at 8:56 a.m. ET on Sunday. “Following a wave of attacks, we have a number of security patches to push.”

LNbits later said it had disabled all instances on its managed hosting service, my.lnbits.com, as a precaution. It said services would resume within 24 hours.

The software lets operators create wallets and payment applications on top of a connected funding source. Its documentation lists backends including LND and Core Lightning. The shutdown instruction was directed at LNbits servers, not every node on the Lightning Network.

From Paywall Warning to Full Shutdown

An earlier LNbits warning asked operators to disable the Paywall extension immediately while developers investigated a potential bug. The subsequent instruction covered all LNbits servers, rather than only installations using that extension.

The shutdown notice did not identify vulnerable versions, explain the attack route or state a total loss amount. It also did not exempt any funding-source configuration from the stop-server instruction.

In a first-hand account on X, operator Kevin Ravensberg said about 2.29 million satoshis had been withdrawn from his LNbits instance by newly created accounts before he could stop the server. He pledged to make BitTipBot users whole, but said they would be unable to access funds until LNbits patched the vulnerabilities.

At publication, the project's GitHub releases page still listed v1.6.2, a PostgreSQL backup hotfix released Sept. 18, as its latest release. It did not list a release addressing Sunday's attacks.

LNbits contributor Ben Arc said patches “should be merged and available within 24-48hrs.”