Lightning Wallet Platform LNbits Orders Emergency Shutdown After Attackers Drain Funds

If you run an LNbits server, the instruction from the project itself is simple: turn it off. LNbits, the open-source Lightning wallet and accounts platform, told all operators to stop their servers immediately on November 8 after what it called a wave of attacks, with security patches still pending.

HOW IT ESCALATED

The shutdown order did not come out of nowhere. LNbits first asked operators to disable its Paywall extension at 12:33 UTC on November 8 while it investigated a possible bug, then broadened the warning to everyone running an LNbits server at 13:56 UTC. The full shutdown notice came about 80 minutes after that first, narrower warning.

WHAT WAS ACTUALLY TAKEN

Attackers exploited account creation and withdrawal functions across multiple instances, draining at least 2,285,545 satoshis from one confirmed victim. Bittipbot operator Kevin Ravensberg said attackers created new accounts on his LNbits instance and withdrew that amount, roughly 0.0229 BTC, between 09:22 and 14:00 UTC on November 8. Ravensberg said BitTipBot users could not access their funds until the vulnerabilities were patched, and he pledged to reimburse them personally.

WHERE THE FIX STANDS

LNbits contributor Ben Arc said in a November 8 post that patches should be merged and available within 24 to 48 hours. As of the following day, operators were still waiting. LNbits operators were still waiting for a published security release on November 9, more than a day after the shutdown order, with the project's official GitHub release history still listing an older September hotfix as its latest version and no incident-specific release or restart protocol posted.

One distinction is worth being precise about. The shutdown instruction was directed at LNbits servers, not every node on the Lightning Network. The exploit hit a specific wallet implementation built on top of Lightning, not the base payment network itself. Anyone running an LNbits server should keep it offline and watch the project's official channels for the patch before bringing it back online.

This story comes from the Simply Bitcoin Live show. Watch the full episode.