LNbits Urges All Server Operators to Shut Down After Wave of Attacks

LNbits, the open-source Lightning wallet and accounts platform, told all server operators to stop their servers immediately on Nov. 8 after what it described as "a wave of attacks," with security patches still pending.

"All LNbits users should stop their LNbits servers IMMEDIATELY," the project posted on X at 8:56 a.m. ET on Sunday. "Following a wave of attacks, we have a number of security patches to push."

The project later said it had disabled all instances on its managed hosting service, my.lnbits.com, as a precaution, and that services would resume within 24 hours.

The software allows operators to create wallets and payment applications on top of a connected funding source, with its documentation listing backends including LND and Core Lightning. The shutdown instruction was directed at LNbits servers only, not at every node on the Lightning Network. In other words, the order targeted the application layer that runs on top of a Lightning node, not the node backends themselves. And because an LNbits instance can hold balances for people who use an operator's wallet apps without running any infrastructure of their own, a flaw at this layer can expose funds belonging to end users rather than only to whoever deployed the server.

From Paywall Warning to Full Shutdown

The full stop-server order followed an earlier LNbits warning that asked operators to disable the Paywall extension immediately while developers investigated a potential bug. The subsequent instruction covered all LNbits servers, rather than only installations using that extension.

The shutdown notice did not identify vulnerable versions, explain the attack route, or state a total loss amount. Without a version range to check against, operators could not determine from the announcement alone whether their own installation was affected. The notice also did not exempt any funding-source configuration from the instruction to take servers offline.

Operator Reports Withdrawal From Instance

In a first-hand account on X, operator Kevin Ravensberg said about 2.29 million satoshis — roughly 0.0229 BTC — had been withdrawn from his LNbits instance by newly created accounts before he could stop the server. He pledged to make BitTipBot users whole, but said they would be unable to access funds until LNbits patched the vulnerabilities.

His account illustrates how an attack on a single instance can reach people who never operated the server themselves: the affected balances in this case belonged to users of a service built on his deployment.

Patches Still Pending

At publication, the project's GitHub releases page still listed v1.6.2, a PostgreSQL backup hotfix released Sept. 18, as its latest release, and did not list a release addressing Sunday's attacks.

LNbits contributor Ben Arc said the patches "should be merged and available within 24-48hrs."

Until such a release appears, operators have no patched version to upgrade to, and the stop-server instruction remained in effect at publication. The concrete markers to watch are the GitHub releases page for anything newer than v1.6.2, the stated 24-hour resumption window for my.lnbits.com, and the project's X account for an updated all-clear.