LNbits, an open-source Bitcoin Lightning Network wallet platform, has issued an emergency security warning instructing all operators to shut down their servers immediately following a wave of active cyberattacks. The November 8, 2026, directive initially focused on a suspected vulnerability in the Paywall extension before expanding to every LNbits deployment. Developers also suspended the platform’s hosted my.lnbits.com service as a precaution while preparing multiple security patches. Operators have been advised to keep their systems offline until an official security update confirms that restarting is safe.
ATTACKERS EXPLOIT LNBITS SERVERS AND STEAL BITCOIN
The security incident has already resulted in reported financial losses, with the operator of BitTipBot claiming attackers created unauthorized accounts and withdrew approximately 2.28 million satoshis, equivalent to 0.0229 Bitcoin. The unauthorized transactions reportedly occurred over five hours on November 8. Although LNbits personnel helped investigate the suspected extension exploit, the platform has not publicly identified all affected vulnerabilities or confirmed the total number of compromised servers. Developers initially estimated that security patches could be available within 24 to 48 hours, but no verified safe version had been announced at the time of reporting.
SECURITY EXPERTS URGE IMMEDIATE DEFENSIVE ACTION
LNbits administrators should immediately disable their servers, preserve security logs, investigate suspicious account activity, and review withdrawal histories for unauthorized transactions. Organizations operating Lightning Network payment services should also examine API credentials, administrative access, and connected financial infrastructure for potential compromise. While the attacks highlight significant risks involving cryptocurrency wallet applications and third-party extensions, there is currently no evidence that the underlying Bitcoin or Lightning Network protocols have been compromised. Operators should avoid restarting affected deployments until LNbits releases verified security patches and official recovery instructions.