LNbits urges users to shut down servers amid wave of attacks

LNbits, the open-source software many people use to run Bitcoin Lightning Network wallets, has asked every user to shut down their servers. The warning arrived on November 8, 2026, after multiple reports that attackers were creating new accounts and pulling funds out without permission.

What happened

The alarm followed a string of successful exploits. According to the reports, attackers were able to open fresh accounts on LNbits instances and then withdraw money they had no right to touch.

One of the clearest public examples came from @KevinR4v, who runs BitTipBot. The operator reported losing approximately 2,285,545 sats, which works out to about 0.0229 BTC.

For readers who don’t count in sats: a sat is the smallest unit of Bitcoin, one hundred-millionth of a single coin. Lightning users tend to think in sats because the network is built for small, fast payments.

The BitTipBot attack reportedly ran across a roughly five-hour window. It started at approximately 9:22 UTC and continued until about 14:00 UTC.

The BitTipBot operator has said they are committed to reimbursing affected users. The funds remain inaccessible until the security patches are applied, so users are waiting on LNbits before they can be made whole.

The patch timeline

After telling users to pull the plug, LNbits said it was working on multiple security patches. The project expects to release them within 24 to 48 hours of the warning.

LNbits also asked the community to spread the advisory as widely as possible. For a decentralized, self-hosted tool, that request makes practical sense. There is no central switch that LNbits can flip to protect every instance. Each operator runs their own server, so each operator has to hear the warning and act on it individually.

This is not the first time LNbits has had to address security problems. Earlier vulnerabilities were fixed in September 2026 with the release of version 1.6.0, which followed an audit by V12.

Background: why LNbits matters

LNbits lets users manage multiple wallets and accounts within a self-hosted layer that sits on top of the Lightning Network. Operators can build tip bots, point-of-sale setups, or shared wallets for groups without handing custody to a large company.

The timing adds context. Other Lightning-related projects, including Electrum and Core Lightning, rolled out their own security updates in early November 2026. No specific link between those updates and the LNbits vulnerabilities has been confirmed.

What this means

The BitTipBot case shows the human cost of that downtime. Even an operator willing to reimburse users cannot do so until the software is fixed, which leaves end users stuck in limbo through no fault of their own.

No immediate market reaction has been observed. The losses reported so far are small in Bitcoin terms, and the incident is centered on a self-hosted tool rather than a major exchange or custodian.

For now, the message from LNbits is blunt. Turn it off, wait for the fix, and tell everyone you know who runs it to do the same.