A powered-down home server on a dark shelf, with a single red LED lit and an unplugged network cable hanging in front
Original AI-generated illustration.

LNbits Tells Every Operator to Shut Down After a Wave of Attacks; One Documented Drain Took 2,285,545 Sats

NodeWitness Team 7 min read

LNbits has asked every operator to stop their server at once after a wave of attacks, while it prepares several security patches. The only publicly documented case so far is BitTipBot: 2,285,545 sats withdrawn by newly created accounts. Version 1.7.0 came out on November 10; updating is not enough, operators also have to rotate keys and credentials.

Update, 11/11/2026: on November 10 at 17:09 UTC, LNbits published v1.7.0 [14]. The project says to install it before running the server again, and that updating is not enough: credentials exposed before the upgrade may still give an attacker access afterwards [15]. If you suspect a compromise, keep the old logs and put v1.7.0 on a seperate server. In every case, rotate all wallet keys (Super Admin → Settings → Users → Reset Wallet Keys), revoke and replace funding-source credentials (API keys, macaroons or the equivalent) and any other secrets stored in settings, and recreate connections for NWC Provider, LNDHub, Bolt Cards, TPOS, Bleskomat and FOSSA [15]. As of November 11 there is still no technical advisory on the bug and no total-loss figure.

LNbits, the open-source Lightning accounts and payments stack that many people run on their own server, told every user at 13:56 UTC on Sunday, November 8, to stop their LNbits server immediately [1]. "Following a wave of attacks, we have a number of security patches to push. Until then, it's better to err on the side of caution," the project wrote on X, in a post that had more than 96,000 impressions when we checked [1].

It is the second self-hosted bitcoin payments program in a week to tell operators to power down, after BTCPay Server on November 1 [8]. The channel is different: the documented thefts here moved over Lightning, with no public on-chain addresses to trace the way that case allowed.

The warning widened in about 90 minutes

The first alert was narrower. At 12:33 UTC, LNbits asked anyone with the Paywall extension enabled to disable it immediately while it investigated a potential bug [2]. Paywall is the add-on that charges for access to content. The 13:56 post already spoke of attacks and of every LNbits server, with or without that extension [1].

Three minutes later, project contributor Ben Arc asked people to forward the warning to anyone who might be running an instance and said patches should be merged and available within 24 to 48 hours [3].

At 17:18 UTC, LNbits said it had disabled all instances on its hosted service, my.lnbits.com, "as a precaution," and that all services would resume within 24 hours [4]. On the morning of November 9 in Madrid time, that site was serving the app shell again; we have not verified whether wallets were already usable [4][11].

The only drain with a public figure

Kevin Ravensberg, who runs BitTipBot on his own LNbits instance, replied to the general warning with the only documented case so far [5]. He says the server was exploited before the announcement: newly created accounts used the exploit and withdrew 2,285,545 sats, about 0.023 bitcoin, between 09:22 and 14:00 UTC, before he could stop the server [5]. He says he will make all BitTipBot users whole, but they will not be able to access funds until LNbits has patched the vulnerabilities [5].

He later added that an LNbits red team and Ben Arc had confirmed which exact extension exploit was used against his server, and that a way to prevent these kinds of attacks is being worked on [6]. He did not name the extension. CriptoNoticias covered the episode the same day in Spanish [7].

What is still unknown

LNbits has not publicly described the nature of the attacks, whether the Paywall warning is the same vector, how many instances were hit, or the total amount taken [1][2][7]. On November 10 it published v1.7.0 [14]; as of November 11 there is still no new security advisory tied to this incident [10]. The project says to install that release before running the server again, then rotate keys and credentials [15]. A technical report on the exploit, LNbits says, will follow later [15].

If you run LNbits on a home node

LNbits installs with one click on several home Bitcoin nodes that ship an app store. The project's own docs list those one-click platforms, and on the Start9 Marketplace it was packaged as LNbits 1.6.2 when we checked on November 9 [12][13].

Until you have installed v1.7.0 and rotated keys and credentials, the safest path is:

  1. Stop the LNbits app or service from the node dashboard (or halt the process if you installed it by hand).
  2. Check balances, newly created accounts and which extensions were enabled, especially Paywall [2].
  3. Keep the instance offline until you have installed v1.7.0 and rotated keys and credentials, as the project's guide sets out [15].
  4. Treat any sats sitting in LNbits wallets as hot funds on the node: move them to a wallet whose keys never live on that server, along the lines of our custody comparison.

Hot funds on the server, keys elsewhere

LNbits is not a cold on-chain wallet with its own seed phrase. On node platforms it rides on the node's Lightning wallet (LND or Core Lightning): the instance operator can open wallets for other people, and those balances ultimately leave from the same node [12]. Whoever abuses the instance can pull sats out over Lightning. That is why Ravensberg's drain leaves no public chain of addresses comparable to the BTCPay case.

The lesson tracks last week's. A payments program that stays online is convenient, and it is also the first place a bug turns into lost money. The project now says to install v1.7.0 before running the server again, then rotate keys and credentials [15]. Keep a seperate note of which extensions you had enabled so you can re-check them after the update.

Sources

Source type in brackets. Times in UTC. Checked on November 9, 2026, except [14] and [15], checked on November 11.

  1. LNbits, post on X, 13:56 UTC on November 8, 2026. Immediate shutdown request; wave of attacks; pending patches. 96,160 impressions at query time. (Primary, project)
  2. LNbits, post on X, 12:33 UTC on November 8, 2026. Disable the Paywall extension immediately. (Primary, project)
  3. Ben Arc (@arcbtc), post on X, 13:59 UTC on November 8, 2026. Patches within 24 to 48 hours; forward the warning. (Primary, project contributor)
  4. LNbits, post on X, 17:18 UTC on November 8, 2026. my.lnbits.com disabled; resume within 24 hours. (Primary, project)
  5. Kevin Ravensberg (@KevinR4v), post on X, 15:29 UTC on November 8, 2026. 2,285,545 sats withdrawn between 09:22 and 14:00 UTC; pledge to make BitTipBot users whole. (Primary, affected operator)
  6. Kevin Ravensberg, reply on X, 17:47 UTC on November 8, 2026. Extension confirmed by red team and Ben Arc, not named publicly. (Primary, affected operator)
  7. CriptoNoticias, LNbits pide a todos sus usuarios detener sus servidores tras una «oleada de ataques», Franco Scandizzo, November 8, 2026. (Secondary, press)
  8. NodeWitness, BTCPay Server Attacker Has Collected 18.46 BTC as Project Ties Hot Wallet Drains to Outdated Versions, November 2, 2026. (Primary, own)
  9. LNbits, GitHub releases, latest v1.6.2 published September 18, 2026. Checked November 9. (Primary, project)
  10. LNbits, GitHub Security Advisories, checked November 9, 2026: no new advisory tied to this incident. (Primary, project)
  11. https://my.lnbits.com/, own HTTP check on the morning of November 9, 2026 (Madrid time). (Primary, own check)
  12. LNbits, Node Platforms, official one-click install docs for home Bitcoin nodes. (Primary, project)
  13. Start9 Marketplace, LNbits 1.6.2 listing, checked November 9, 2026. (Primary, platform)
  14. LNbits, v1.7.0 on GitHub, published November 10, 2026 at 17:09 UTC. Urgent security update. (Primary, project)
  15. LNbits, LNbits 1.7.0: security update and upgrade guidance, November 10, 2026. Updating is not enough; operators must also rotate keys and credentials. (Primary, project)

More in Privacy and self-custody

See all 34 articles in Privacy and self-custody →

Last updated: November 9, 2026