Key Takeaways
- LNbits urged all server operators to shut down immediately following a wave of reported attacks on Nov. 8.
- A Bittipbot operator reported losing 2,285,545 satoshis after attackers created unauthorized accounts.
- Developers expect security patches within 24 to 48 hours, while LNbits’ hosted service remains suspended.
LNbits Sounds the Alarm as Lightning Network Attacks Unfold
The security warning arrived at approximately 13:56 UTC on Nov. 8, when LNbits published an unusually urgent announcement through its official X account. Rather than advising operators to install an update at their convenience, developers called for an immediate shutdown of all running instances.
The LNbits X account said:
“All LNbits users should stop their LNbits servers IMMEDIATELY. Please forward this announcement. Following a wave of attacks, we have a number of security patches to push. Until then, it’s better to err on the side of caution. Updates to follow soon.”
Core contributor Ben Arc reinforced the directive, explaining that developers expected patches to become available within 24 to 48 hours. He also encouraged community members to circulate the warning to anyone operating LNbits infrastructure.
The trouble had surfaced earlier. At approximately 12:33 UTC, LNbits advised operators using its Paywall extension to disable the feature immediately while developers investigated a potential vulnerability. The subsequent systemwide shutdown warning suggested the security concerns extended beyond a single extension.
LNbits also suspended instances running through its hosted service, my.lnbits.com, with developers indicating that operations could resume within 24 hours once the necessary fixes were implemented.
Attackers Drain Lightning Funds as Operator Promises Reimbursement
One documented incident involved Dutch operator Kevin Ravensberg, whose LNbits instance supports Bittipbot, a Telegram-based tipping service.
According to Ravensberg, attackers created new accounts and withdrew 2,285,545 satoshis between 9:22 a.m. and 2 p.m. UTC on Nov. 8. The stolen amount equals approximately 0.02285545 BTC. Ravensberg pledged to reimburse affected Bittipbot users personally, although access to funds would remain restricted until developers addressed the vulnerabilities.
The reported sequence raises uncomfortable questions about LNbits’ account-management and authorization mechanisms. However, investigators have not publicly established the precise exploit responsible for the unauthorized withdrawals.
LNbits operates as a modular payment system connected to Lightning funding sources, including LND and Core Lightning. Its architecture supports separate wallets, application programming interfaces, payment terminals, tipping services and numerous optional extensions.
That flexibility also introduces additional software components requiring security oversight, particularly when installations are accessible over the public internet.
Lightning Network Security Troubles Extend Beyond LNbits
The emergency follows a difficult year for Lightning Network infrastructure, with developers confronting vulnerabilities across several prominent implementations, including Core Lightning, Lightning Development Kit (LDK), and Eclair.
In August, Core Lightning maintainers confronted numerous AI-assisted vulnerability reports, several of which exposed genuine security problems. Developers recommended emergency precautions while preparing fixes, and approximately 22% of Core Lightning nodes reportedly went offline during the disruption.
September and October brought additional security releases addressing denial-of-service attacks, channel-closing weaknesses, transaction-signing problems and potential fund losses.
LDK developers patched a particularly concerning reconnect vulnerability that could induce affected nodes to sign conflicting commitment transactions. Core Lightning, meanwhile, issued successive updates addressing memory exhaustion, channel-management weaknesses, and other security defects.
LNbits had already undergone security scrutiny earlier in 2026. An external review by V12 identified an authentication-cache bypass and a Paypal integration weakness, both reportedly corrected in version 1.6.0. There is currently no established connection between those previously patched defects and Sunday’s attacks.
Can Lightning Operators Safely Resume Service?
For now, LNbits operators face a straightforward instruction: Keep affected infrastructure offline until developers release and verify the necessary security patches. The project’s immediate priority is to contain further unauthorized withdrawals, identify the compromised components, and restore services without exposing additional funds.
The broader concern extends beyond one wallet platform. Lightning applications frequently combine payment infrastructure, authentication systems, and third-party extensions, meaning weaknesses outside the underlying payment protocol can still expose users to financial losses.
Sunday’s emergency illustrates a persistent distinction in cryptocurrency security: A functioning payment network does not guarantee the safety of every application built upon it. For LNbits, restoring service may prove easier than establishing precisely how attackers breached its defenses.
Moreover, according to newhedge.io stats, since late July, the Lightning Network has shed more than 1,100 BTC in capacity, retreating to levels last recorded in mid-2022.
