In response to a series of security breaches, LNbits, a popular open-source platform for Bitcoin Lightning wallets, has advised all operators to immediately shut down their servers. This urgent call to action was issued on November 9, 2026, following multiple reports of system vulnerabilities being exploited.
Immediate Precautions and Security Fixes
LNbits has announced its intention to release several security patches to address these vulnerabilities. Operators are being urged to remain vigilant and keep their systems offline until the patches are made available. A notable incident involved an operator who reported the unauthorized withdrawal of 2,285,545 satoshis, approximately 0.023 bitcoin, due to an exploit targeting new accounts.
The initial advisory from LNbits came 80 minutes after a preliminary warning, which specifically advised the deactivation of the Paywall add-on—an extension that requires users to pay for content access. This measure was recommended while the team investigated potential software bugs.
Current Status and Developer Response
As of 09:00 UTC today, LNbits has not yet released a patched version of the software. There have been no updates or alternative solutions provided via their X account, and operators have not received guidance on verifying potential breaches in their systems prior to shutdown.
Ben Arc, a developer at LNbits, estimated in a recent update that the necessary patches should be integrated and available within the next 24 to 48 hours. This timeline suggests that fixes might be accessible between 14:00 UTC today and 14:00 UTC tomorrow.
Impact on Users and Future Outlook
In light of these developments, LNbits has also deactivated all instances of its cloud service, my.lnbits.com, with a commitment to restore services within 24 hours, aiming for a return by 17:20 UTC today. Meanwhile, Kevin Ravensberg, the operator who initially reported the exploit, has detailed his experience on X, revealing that his server was compromised hours before the official shutdown notice was issued.
Ravensberg has assured users of BitTipBot, a Telegram-based service, that they will be reimbursed for their inaccessible funds once the vulnerabilities are resolved. He noted that Arc and a team of security experts have identified the specific extension that was exploited, though neither Ravensberg nor LNbits has publicly named the extension involved.
While the advisory is specific to LNbits servers, it does not extend to Lightning nodes or other wallet software. The full scope of the attacks remains undisclosed, with no official figures on the number of affected servers or the total financial impact.
