LNbits, the popular open-source platform that layers wallets, accounts, and applications on top of Bitcoin Lightning nodes, has urged every operator to shut down their servers immediately following a wave of attacks that exploited its software’s authorization or account logic.
What went wrong
On November 8, LNbits first sounded the alarm at about 12:33 UTC, advising operators using the Paywall extension to disable it while the team investigated a potential vulnerability. Roughly 80 minutes later, at 13:56 UTC, the warning expanded: the project directed all LNbits operators—self-hosted or hosted—to take their instances offline “immediately,” citing ongoing unauthorized account creation and withdrawals. Developers promised that multiple security patches were forthcoming.
Confirmed impact
The clearest damage reported so far comes from a Dutch operator known as Kevin Ravensberg, whose server powers the BitTipBot Telegram tipping service. Attackers allegedly created new user accounts on his LNbits instance and withdrew 2,285,545 satoshis—about 0.02285545 BTC—over a span from ~09:22 to 14:00 UTC before he shut things down. Ravensberg has pledged to reimburse affected users.
Scope, unknowns, and what’s being done
LNbits has also shut off all instances run through its hosted my.lnbits.com service, saying operations there will resume once fixes are in place—likely within 24 hours of the warning. Core contributor Ben Arc has estimated a 24–48 hour window for patches to be merged and made available.
Several key questions remain unanswered. LNbits has not identified which versions were vulnerable, whether the Paywall extension was the main culprit, or how the exploit worked. It’s also unclear how many installations were affected or the total sum stolen beyond the BitTipBot case.
Why this matters
Because LNbits is modular and open-source, it’s widely used by individuals, shops, tipping bots, and community services. Users don’t run separate Lightning nodes themselves—those credentials and funds live with each operator. That means if an operator’s LNbits instance is compromised, funds tied to that operator’s node are exposed, even though the underlying Lightning protocol or Bitcoin blockchain is not at fault.
Hyper-distributed infrastructure like this depends on operators acting fast. LNbits’ warnings put the burden on each operator, especially because there’s no single switch that can instantly secure all instances. This incident follows recent security incidents in Lightning node implementations—and highlights how vulnerabilities in add-ons or account logic can have serious financial consequences.
Analytically, this episode underlines a growing risk in the Bitcoin Lightning ecosystem: the more features and extensions layered on top of nodes, the more vectors for compromise. For LNbits—and potentially for any similarly built service—the key risks lie not just in core wallet logic but in every extension the community enables. What to watch: when a patch drops, whether it uncovers that Paywall was the exploit source (or if another extension or core module was responsible), and how many users/operators were truly affected. Until then, shutting down servers as instructed is the safest course of action.
