LNbits, the open-source Bitcoin Lightning wallet and payments platform, ordered all operators to take their servers offline on November 8 following a wave of attacks involving unauthorized account creation and withdrawals. The emergency directive followed an earlier warning targeting its Paywall extension, before developers expanded the shutdown to every LNbits instance. The incident’s financial impact became clearer when BitTipBot operator Kevin Ravensberg reported that attackers had withdrawn 2,285,545 satoshis (0.02285545 BTC) from his server. By Sunday evening, LNbits had disabled all instances on its hosted service, while Ravensberg disclosed that the extension exploited in his case had been identified with assistance from the project’s red team. The vulnerability, affected-instance count and aggregate losses remain undisclosed.
LNbits expands emergency warning from Paywall to all servers
The first security warning appeared at 12:33:40 UTC on November 8, when LNbits instructed operators using its Paywall extension to disable it immediately while developers investigated a potential bug.
Approximately 82 minutes later, at 13:56:18 UTC, the project escalated its response. Its official X account instructed every LNbits operator to stop running their servers immediately, citing a wave of attacks and several security patches that needed to be deployed.
The first warning was limited to Paywall; the next one was the whole server, which is quite a different instruction.
The announcement did not provide a technical explanation of the attacks or identify which components were vulnerable. It also did not establish whether the initial Paywall warning concerned the same vulnerability subsequently identified in the reported theft.
At 17:18:42 UTC, LNbits confirmed that it had disabled all instances operating through its own hosted service, my.lnbits.com, as an additional precaution. The project said it expected services to resume within 24 hours.
The hosted shutdown was a seperate step from the instruction to self-hosted operators. Independent server owners still had to take their own deployments offline rather than relying on LNbits to disable them remotely.
BitTipBot operator reports 2.28 million sats stolen
The clearest publicly quantified financial impact came from Kevin Ravensberg, the operator behind BitTipBot, a Telegram-based Bitcoin tipping service running on LNbits.
Ravensberg disclosed at 15:29:36 UTC that attackers had created unauthorized accounts on his instance and withdrawn 2,285,545 satoshis between 09:22 and 14:00 UTC. The amount represents approximately 0.02285545 BTC.
The reported attack began more than three hours before LNbits issued its initial Paywall warning and continued until shortly after the systemwide shutdown announcement. The operator said he would personally reimburse affected BitTipBot users.
At 17:47:21 UTC, Ravensberg published another update following discussions with LNbits developers. He said the project’s red team, with assistance from founder Ben Arc, had identified the extension exploited in the attack and was working on a way to prevent similar incidents.
The operator later recieved help from the LNbits red team in identifying the extension used against his instance, he said. Its name has not been publicly disclosed, and the project has not confirmed whether it was the Paywall extension identified in the initial warning.
The identification provides a more specific direction for the investigation, but it does not establish how many other deployments were affected through the same component. Ravensberg’s reported loss also represents one instance, not an estimate of total funds stolen across the platform.
The incident targets LNbits infrastructure, not Bitcoin itself
LNbits operates as a wallet and account-management layer built on top of Bitcoin Lightning funding sources. Its modular architecture allows operators to create separate wallets for users and deploy payment applications through extensions supporting services such as tipping, point-of-sale systems and paywalls.
This structure makes the security of the LNbits application and its extensions particularly important. A vulnerability affecting account creation or withdrawal permissions can expose funds accessible through an operator’s instance, even when the underlying Lightning infrastructure continues functioning normally.
There is currently no public evidence that Bitcoin’s underlying protocol or the Lightning Network itself was compromised. The emergency directive specifically concerned LNbits servers and their associated software components.
The incident follows other security-related interruptions affecting Bitcoin payment infrastructure. Dave Finances previously reported how Swiss Bitcoin Pay shut down its servers following a suspected internal-system breach, while Blink Wallet suspended services after unauthorized withdrawals from custodial accounts.
Those incidents involved different platforms and attack circumstances, but each demonstrated how vulnerabilities or suspected compromises in the software surrounding cryptocurrency payments can interrupt customer access even without evidence of a wider blockchain failure.
A separate report on security weaknesses affecting ZEUS and other crypto payment systems also documented vulnerabilities involving Lightning swaps and transaction verification. No connection between those findings and the LNbits attacks has been established.
Security patches remain the main outstanding development
LNbits contributor Ben Arc said the necessary security patches should be merged and made available within 24 to 48 hours of the emergency announcement. That was an expected development timeline, rather than confirmation that a working fix had already been released.
The project’s public release history still listed version 1.6.2, released on September 18, as its latest release when checked on November 9. An incident-specific advisory had not been pubished, and the available notices do not identify the vulnerable software versions.
The estimate is not a definate restart date, and it should not be read as one. LNbits has not publicly established when self-hosted operators can safely resume their services or whether additional recovery procedures will be required.
Several questions therefore remain unanswered: the precise vulnerability, the identity of the exploited extension, the number of compromised instances, the total cryptocurrency losses and whether the Paywall warning concerned the same attack mechanism.
For now, the confirmed picture remains limited to a systemwide shutdown directive, the suspension of LNbits’ hosted instances, one operator-reported theft of 2,285,545 sats and a privately identified extension exploit. The technical explanation and a verified patch will determine how much more can be established about the incident.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.