LNbits exploit: Bitcoin Lightning wallet servers urged to shut down amid active fund-theft attacks
Severity: high · Patch status: unpatched · Since 2026-11-09
The LNbits project urged all operators of its free, open-source Bitcoin Lightning wallet system to shut down their servers on 2026-11-08 amid a wave of attacks exploiting an extension vulnerability. Operator Kevin Ravensberg reported attackers created new accounts via an exploit and withdrew 2,285,545 satoshis (~0.023 BTC) from his server between 09:22 and 14:00 UTC, before the project's first warning; he operates BitTipBot, a Telegram bot whose users' funds are inaccessible. The project initially asked operators to disable the Paywall add-on, then issued a full shutdown notice ~80 minutes later and took its own hosted instances (my.lnbits.com) offline. Security testers confirmed the exact extension exploited, but it had not been named publicly. Patches were estimated to land within 24-48 hours; no fixed version was available as of 09:00 UTC on 2026-11-09.
What to do
- Shut down any LNbits server immediately until patched fixes are released
- Disable the Paywall extension and audit other extensions for unexpected withdrawals or new accounts
- Check wallet balances and transaction logs for unauthorized withdrawals since at least 2026-11-08 09:22 UTC
- Notify users of dependent services (e.g., bots, payment flows) about frozen funds and potential losses
- Monitor LNbits channels for the patched release, then apply it and review all extensions before restarting
Sources
All live incidents on Threat Watch
