Threat watch / Attack
LNbits: Lightning wallet servers told to shut down during a wave of attacks, then patched in 1.7.0
On November 8, 2026, the LNbits project, open-source software that people run to offer Bitcoin Lightning wallets, told every operator to "stop their LNbits servers IMMEDIATELY" after "a wave of attacks", and took its own hosted service offline. One operator reported 2,285,545 sats (about 0.023 BTC) withdrawn that day. On November 10, LNbits released version 1.7.0 as an urgent security update and said versions before it are at risk. It has not yet explained the exploit or said how many servers were hit.
- Sector
- Many sectors
- Way in
- Not public yet
- Product or vendor
- LNbits
- How it happened
- Not public yet in detail. LNbits first told operators to disable its Paywall extension while it investigated a potential vulnerability, then told everyone to shut down. Version 1.7.0 brings "important vulnerability fixes" and stronger authentication, extension management and payment handling, but LNbits has not said which flaw was used and says a separate report will follow. At the operator who reported a loss, the attackers created new accounts and withdrew funds.[1][2][3][4] Checked 11 Nov 2026
- What was stolen
- Bitcoin held on LNbits servers. The only figure public is one operator's loss of 2,285,545 sats (about 0.023 BTC), reported by Kevin Ravensberg, who runs the BitTipBot Telegram tipping service. LNbits has not published a total.[1][3] Checked 11 Nov 2026
- Who was impacted
- Operators running LNbits before 1.7.0, and their users. LNbits has not said how many servers were attacked.[1][3][4] Checked 11 Nov 2026
- Threat actor
- Not attributed
Timeline
- Between about 09:22 and 14:00 UTC, attackers create new accounts on Kevin Ravensberg's BitTipBot server and withdraw 2,285,545 sats, according to his report. [3][5]
- LNbits first warns operators to disable its Paywall extension. About 80 minutes later, at about 13:56 UTC, it posts: "All LNbits users should stop their LNbits servers IMMEDIATELY", citing "a wave of attacks" and security patches to come. Its hosted service my.lnbits.com is also switched off. [1][2][5]
- LNbits releases v1.7.0, "URGENT SECURITY UPDATE". It tells operators to upgrade before restarting, rotate wallet keys and funding-source credentials, treat secrets stored in LNbits settings as compromised, and set up a fresh server if they suspect a compromise, since updating alone does not remove access an attacker already has. [3][4][6]