LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks Swati KhandelwalNov 09, 2026Vulnerability / Cryptocurrency Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could stop it. The shutdown notice came about 80 minutes after a first, narrower warning. That warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug. As of 09:00 UTC today, the project had not released a fixed version. On X, it had not canceled the notice, offered another option, or told operators how to check whether their servers were hit before they were shut down. Ben Arc, an LNbits developer, said in a patch estimate yesterday that patches "should be merged and available within 24-48hrs." Counted from his post, that means between about 14:00 UTC today and 14:00 UTC tomorrow. The project also switched off all the LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday. It said in a hosted-service notice that all services would be back within 24 hours, or by about 17:20 UTC today. Kevin Ravensberg, the operator who reported the loss, said in a loss report on X that his server was exploited before the shutdown notice. The attack ran from 09:22 to 14:00 UTC yesterday, starting more than three hours before the project's first warning at 12:33 UTC. He has promised to repay users of BitTipBot, a Telegram bot. They cannot reach their funds until the project fixes the flaws. Later yesterday, Ravensberg said in a follow-up post that Arc and a team of security testers had confirmed "which exact extension exploit was used" on his server. Neither he nor the project had named that extension in posts on X as of 09:00 UTC today. The project also had not said whether it is Paywall, the add-on named in its first warning. The shutdown notice covers LNbits servers and does not mention Lightning nodes or other wallet software. It did not say how many servers were attacked or how much was taken. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cryptocurrency, Cyber Attack, Vulnerability, Web Security PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them AI-Generated Fake Login Pages Are Making Account Takeovers Easier American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk