Key Takeaways
LNbits urged all operators to shut down their servers after attackers reportedly created unauthorized accounts and withdrew funds.
One affected operator reported losing 2,285,545 satoshis (0.0228 BTC), worth approximately $1,700.
Developers expected security patches within 24 to 48 hours, but had not yet confirmed that servers were safe to restart.
What Happened in the LNbits Security Incident?
LNbits, an open-source software used to manage Bitcoin Lightning wallets and payments, has urged all users to shut down their servers immediately following a series of reported security attacks.
The warning was issued on November 8 after attackers reportedly created unauthorized accounts on LNbits servers and used them to withdraw funds. One operator reported losing more than 2.28 million satoshis (0.0228 BTC), raising concerns about the security of applications built on top of the Lightning Network.
In an urgent announcement on X, LNbits told users, “All LNbits users should stop their LNbits servers IMMEDIATELY. Please forward this announcement.”
The project said it was preparing several security patches to address the attacks and advised operators to keep their servers offline until further notice.
The shutdown warning followed an earlier security alert involving LNbits' Paywall extension. Initially, the project asked operators to disable the extension while developers investigated a potential vulnerability.
However, the warning was later expanded to cover all LNbits servers, suggesting that the security concerns were not limited to the Paywall extension.
LNbits also suspended its hosted service, my.lnbits.com, as a precaution. The project said the service could resume shortly, depending on the progress of the security fixes.
Ben Arc, a contributor to LNbits, said developers expected the patches to be ready within 24 to 48 hours. However, this was an estimated timeline, not confirmation that a fix had been released or that operators could safely restart their servers.
One reported victim of the attacks was Kevin Ravensberg, a Dutch operator who runs BitTipBot, a Telegram-based Bitcoin tipping service built on LNbits.
According to Ravensberg, attackers created unauthorized accounts on his LNbits server and withdrew 2,285,545 satoshis, equivalent to approximately $1,700 at today’s prices.
Kevin Ravensberg on X
The withdrawals reportedly took place between 9:22 AM and 2 PM UTC on November 8.
Ravensberg said he would personally reimburse affected BitTipBot users. However, he explained that users would have to wait until LNbits developers fixed the security problems before they could access their funds again.
It is important to note that this figure represents one operator's reported loss. LNbits has not published a total estimate of stolen funds or confirmed how many servers were affected.
The exact method used by the attackers also remains unknown.
LNbits is an open-source application that allows users to create and manage multiple Bitcoin Lightning wallets.
It connects to existing Lightning infrastructure, including LND and Core Lightning, and makes it easier to build services such as payment terminals, tipping bots and shared wallets.
For example, a business can use LNbits to accept Lightning payments without having to build its own payment system from scratch.
However, because LNbits adds another software layer between users and their Lightning funding sources, security problems within the application can put connected funds at risk.
This distinction is important. The latest incident involves LNbits software and does not mean that Bitcoin itself or the Lightning Network protocol has been hacked.
The LNbits incident comes amid wider security concerns across the Lightning Network ecosystem.
Other projects, including Core Lightning, Lightning Development Kit (LDK) and Eclair, have also faced security vulnerabilities and released updates to address various issues.
LNbits itself had previously undergone a security review by V12, an autonomous AI-powered security analysis and code-auditing platform, in late September 2026. The review identified weaknesses involving authentication caching and its PayPal integration. Those issues were reportedly fixed in version 1.6.0.
However, there is currently no confirmed connection between those earlier vulnerabilities and the latest attacks.
