Shut It Down. The Wallets Are Under Attack.
If you run an LNbits server, the project has one message for you: turn it off. Not later. Now.
On Saturday, November 8, LNbits — the free, open-source wallet system that lets anyone run a Bitcoin Lightning wallet — told every operator to shut down their servers amid a wave of attacks. The project is working on several security fixes, but as of Monday morning none had been released. Until they are, the safest thing an operator can do is stop the server entirely.
That is an unusually blunt instruction, and the reason for it is unusually concrete. At least one operator has already lost money.
The attack that forced the shutdown
Kevin Ravensberg, an LNbits operator, reported that an exploit drained 2,285,545 satoshis — about 0.023 bitcoin — from his server. The attack ran from 09:22 to 14:00 UTC on November 8, and it started more than three hours before the project issued its first warning.
Ravensberg’s server powers BitTipBot, a Telegram bot that holds users’ funds. Those users cannot reach their money until the project ships its fixes, and Ravensberg has promised to repay them out of his own pocket.
The day moved fast:
- 09:22 UTC, November 8: the attack on Ravensberg’s server begins.
- 12:33 UTC: LNbits issues its first, narrower warning, asking operators to disable Paywall — an add-on that charges people to view content — while the project investigates a possible bug.
- About 80 minutes later: the project escalates to a full shutdown notice for all LNbits servers.
- Later on November 8: the project switches off the LNbits instances it runs for users on its own hosted service, my.lnbits.com, saying services would return within 24 hours.
By Monday morning, no fixed version had been released. Developer Ben Arc estimated on Sunday that patches “should be merged and available within 24–48hrs” — somewhere between Monday afternoon and Tuesday afternoon UTC. On X, the project had not cancelled the shutdown notice, offered another option, or told operators how to check whether their servers were hit first.
What we know — and what we don’t
Late on Sunday, Ravensberg said Arc and a team of security testers had confirmed “which exact extension exploit was used” on his server. But neither he nor the project had publicly named that extension as of Monday morning, and the project had not confirmed whether it is Paywall, the add-on named in the first warning.
That gap matters: you cannot yet tell whether your own server was hit, or which add-on to blame. The notice covers LNbits servers only — not Lightning nodes or other wallets — but it does not say how many servers were attacked or how much was taken. One operator’s loss is confirmed; the full scale is not.
What operators should do now
If you run an LNbits server, treat this as an active incident, not a routine update:
- Shut the server down if you have not already. That is the project’s own instruction, and it is the only mitigation available until the fixes land.
- Check your balances and transaction history before and after the shutdown, and look for withdrawals you did not authorize — especially new accounts created around November 8.
- Review which extensions are installed, Paywall included, and be ready to disable or remove them before restarting. Do not restart on the old code and hope for the best.
- Watch for the patched release and apply it the moment it appears, then verify your balances again before letting users back in.
If you use a hosted LNbits wallet rather than running your own server, check with your provider. The project’s own hosted service was switched off on Sunday with a 24-hour return window, and other hosts may have taken the same step.
Why this one matters
LNbits is infrastructure, not a single app. It is the wallet layer underneath tipping bots, small shops, and community projects — the kind of places where the person running the server is often one volunteer with a weekend project, not a security team. An attack that drains funds through an extension, with no fix available and no way to check whether you were hit, is exactly the scenario those operators are least equipped to handle.
It is also a reminder that the crypto world keeps producing the same lesson in new forms. A few days ago, attackers walked $133 million out of a French bank through a service provider and converted it into stablecoins. Here the sums are smaller, but the shape is the same: the money moves through a trusted intermediary, and the people who trusted it find out last.
The response has been fast and honest: the project warned operators, escalated to a shutdown when the picture got worse, and pulled its own hosted service offline rather than leaving users exposed. But the fixes are still coming, and until they arrive, the only safe LNbits server is one that is off.
If you run one, keep it off. Watch for the patched release, apply it the moment it lands, and only then bring your server — and your users’ funds — back online. The same discipline applies well beyond LNbits: when the platform holding your keys is the one that gets breached, assuming the worst and acting fast is the only move that works.