LNbits maintainers order all Bitcoin Lightning wallet operators to shut down servers

LNbits maintainers ordered all Bitcoin Lightning wallet server operators to shut down immediately on November 8, 2026, after attacks continued against self-hosted instances.

The project first warned operators at about 12:33 UTC on November 8, 2026, to disable the Paywall extension while investigating a potential bug, then issued the systemwide shutdown order at approximately 13:56 UTC, about 80 minutes after the first warning. LNbits switched off all instances on its hosted service, my.lnbits.com, as a precaution. The notice targets LNbits servers only and does not refer to other wallet software or Lightning nodes.

Because LNbits is decentralized and self-hosted, each operator must hear the warning and shut down individually; there is no central switch. The directive applied only to LNbits servers and not to other wallet software or Lightning nodes.

Operator Kevin Ravensberg reported attackers created new accounts on his LNbits server and withdrew 2,285,545 satoshis before he could stop them on November 8, 2026. Ravensberg said the loss equaled about 0.023 bitcoin. His server was exploited between 09:22 and 14:00 UTC, starting more than three hours before LNbits’ initial public alert at 12:33 UTC. Ravensberg operates BitTipBot, a Telegram tipping service, and promised to repay affected users personally.

Security testers working with LNbits developer Ben Arc confirmed which exact extension exploit was used on Ravensberg’s server. Neither Ravensberg nor the project had publicly named the exploited extension as of 09:00 UTC on November 9, 2026. LNbits had not stated whether Paywall was the extension exploited in the attacks, and sources do not confirm Paywall as the exploited extension.

Ben Arc estimated patches would be merged and available within 24 to 48 hours, saying they “should be merged and available within 24-48hrs.” That estimate covers roughly 14:00 UTC on November 9, 2026, to 14:00 UTC on November 10, 2026. As of 09:00 UTC on November 9, LNbits had not released a fixed version. No security advisory or new release appeared on GitHub by Sunday evening on November 8, 2026.

Affected users cannot reach their funds until LNbits releases patches for the flaws. The project had not offered operators an alternative or a way to check whether servers were hit before shutdown as of 09:00 UTC on November 9.

LNbits said hosted services would resume within 24 hours, or by about 17:20 UTC on November 9, 2026. A vulnerability in LNbits enables an attacker to transfer funds held by the operator’s node, regardless of whether the Lightning software underneath is responsible.

The project has not disclosed the number of servers compromised or the total funds stolen from affected instances. No immediate market reaction has appeared, and the reported losses are small in Bitcoin terms.

LNbits is self-hosted software that runs on top of a Lightning node or funding source and supports many separate wallets and accounts. The project operates using LND and Core Lightning as backends and includes dozens of optional extensions. The incident does not affect Bitcoin’s base-layer blockchain or settlement rules.

LNbits fixed earlier vulnerabilities in September 2026 with version 1.6.0 following an audit by V12, and the most recent release before the incident was v1.6.2 from September 2026. No established connection exists between those previously patched defects and the November 8 attacks. Other Lightning projects including Core Lightning and Electrum issued security updates in early November 2026, with no confirmed link to LNbits. Lightning Network public capacity was about 3,195 bitcoin on November 3, 2026, down from about 5,746 bitcoin on January 4, 2026.