LNbits, the open-source software widely used to run Bitcoin Lightning Network wallets, has asked every user to shut down their servers. The warning was issued on November 8, 2026, after multiple reports that attackers had been creating new accounts on LNbits instances and withdrawing funds without permission.

What Happened

The alarm followed a string of successful exploits. According to the reports, attackers were able to open fresh accounts on LNbits instances and then withdraw money they had no right to touch.

One of the clearest public examples came from @KevinR4v, who runs BitTipBot. The operator reported losing approximately 2,285,545 sats, which works out to about 0.0229 BTC. For readers who do not count in sats: a sat is the smallest unit of Bitcoin, one hundred-millionth of a single coin. Lightning users tend to think in sats because the network is built for small, fast payments.

The BitTipBot attack reportedly ran across a roughly five-hour window. It started at approximately 9:22 UTC and continued until about 14:00 UTC.

The BitTipBot operator has said they are committed to reimbursing affected users. The funds remain inaccessible until the security patches are applied, so users are waiting on LNbits before they can be made whole.

The Patch Timeline

After telling users to pull the plug, LNbits said it was working on multiple security patches. The project expects to release them within 24 to 48 hours of the warning.

That window is the concrete timeline to watch. Both the restart of shut-down instances and the promised BitTipBot reimbursements sit behind the patches, so the next checkpoint is whether the release arrives on schedule.

LNbits also asked the community to spread the advisory as widely as possible. For a decentralized, self-hosted tool, that request makes practical sense. There is no central switch that LNbits can flip to protect every instance. Each operator runs their own server, so each operator has to hear the warning and act on it individually.

This is not the first time LNbits has had to address security problems. Earlier vulnerabilities were fixed in September 2026 with the release of version 1.6.0, which followed an audit by V12.

Background: Why LNbits Matters

LNbits lets users manage multiple wallets and accounts within a self-hosted layer that sits on top of the Lightning Network. Operators can build tip bots, point-of-sale setups, or shared wallets for groups without handing custody to a large company.

The timing adds context. Other Lightning-related projects, including Electrum and Core Lightning, rolled out their own security updates in early November 2026. No specific link between those updates and the LNbits vulnerabilities has been confirmed.

What This Means

Because LNbits instances can run tip bots, point-of-sale setups, and shared wallets, the shutdown request means those services go offline until each operator patches and restarts. The BitTipBot case shows the human cost of that downtime. Even an operator willing to reimburse users cannot do so until the software is fixed, which leaves end users stuck in limbo through no fault of their own.

No immediate market reaction has been observed. The losses reported so far are small in Bitcoin terms, and the incident is centered on a self-hosted tool rather than a major exchange or custodian.

For now, the message from LNbits is blunt. Turn it off, wait for the fix, and tell everyone you know who runs it to do the same.