LNbits has urged every operator of its open-source Bitcoin Lightning wallet system to shut down servers after attacks, including a loss of 2,285,545 satoshis, about 0.023 bitcoin, from one server. The project had not released a fixed version as of 09:00 UTC Nov. 9 and estimates patches within 24 to 48 hours.
LNbits has urged every operator of its open-source Bitcoin Lightning wallet system to shut down servers after a wave of attacks. One operator, Kevin Ravensberg, said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could stop it.
LNbits is a free, open-source Bitcoin Lightning wallet system. Operators run their own servers, and the shutdown notice applies to those servers. It does not mention Lightning nodes or other wallet software.
The shutdown notice came 80 minutes after a narrower warning. That first warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug. Ravensberg's server was attacked from 09:22 to 14:00 UTC Nov. 8, more than three hours before the first warning at 12:33 UTC. His server was exploited before either notice.
Ravensberg said he will repay users of BitTipBot, a Telegram bot. Those users cannot reach their funds until the project fixes the flaws. Later on Nov. 8, he said Ben Arc, an LNbits developer, and a team of security testers confirmed which exact extension exploit was used on his server. Neither Ravensberg nor the project had named that extension on X as of 09:00 UTC Nov. 9. The project had not said whether it is Paywall, the add-on named in the first warning.
As of 09:00 UTC Nov. 9, the project had not released a fixed version. On X, it had not canceled the shutdown notice, offered another option, or told operators how to check whether their servers were hit before they were shut down.
Ben Arc said in a patch estimate on Nov. 8 that patches "should be merged and available within 24-48hrs." Counted from his post, that means between 14:00 UTC Nov. 9 and 14:00 UTC Nov. 10.
The project also switched off all LNbits instances it runs for users on its cloud service, my.lnbits.com, later on Nov. 8. Its hosted-service notice said all services would be back within 24 hours, or by 17:20 UTC Nov. 9.
The notice did not say how many servers were attacked or how much was taken. Operators should shut down servers and keep them offline until fixes arrive. Users of the cloud service must wait for restoration. BitTipBot users cannot reach funds until the flaws are fixed.
Source:LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks, by The Hacker News, The Hacker News, Nov 9, 2026
Comments
Please log in or register to join the discussion
