LNbits Issues Urgent Shutdown Order Following Active Exploits Draining Lightning Funds
On November 8, 2026, the core developers behind LNbits issued an emergency directive instructing all server operators to shut down their instances immediately. The warning followed an active wave of exploits targeting LNbits deployment environments, allowing unauthorized actors to create rogue accounts and drain funds.
At 13:56 UTC on November 8, the project’s official X account published an urgent advisory:
⚠️⚠️ All LNbits users should stop their LNbits servers IMMEDIATELY. ⚠️⚠️
Please forward this announcement.
Following a wave of attacks, we have a number of security patches to push. Until then, it’s better to err on the side of caution. 🙏
Updates to follow soon.— LNbits (@lnbits) November 8, 2026
Incident Breakdown: How the Attack Unfolded
The exploit vectors leverage vulnerabilities inside the LNbits application layer, enabling unauthorized account creation and subsequent capital extraction across vulnerable instances:
Paywall Isolation Attempt: At 12:33 UTC on November 8, the team initially advised operators to disable the Paywall extension.
Full System Shutdown: Within two hours, further analysis revealed the vulnerability extended beyond a single extension, prompting the full-stop shutdown order across self-hosted setups and the hosted platform.
Confirmed Capital Drain: Kevin Ravensberg, operator of the Telegram tipping service BitTipBot, confirmed that attackers created unauthorized accounts between 09:22 and 14:00 UTC, draining 2,285,545 satoshis (~0.0229 BTC).
While the underlying Bitcoin protocol and node software (such as LND or Core Lightning) remain secure, LNbits acts as the account-management frontend. Vulnerabilities at this application layer directly expose node liquidity to unauthorized withdrawal requests.
Key Impact Metrics & Timeline
| Parameter | Details / Metrics |
| Incident Date | November 8, 2026 (~13:56 UTC Official Order) |
| Confirmed Victim Loss | 2,285,545 sats (~0.0229 BTC via BitTipBot) |
| Scope of Attack | LNbits Account Management & Extension Layer |
| Protocol Vulnerability | None (Base Bitcoin P2P & Lightning protocols unaffected) |
| Patch Resolution Window | 24–48 hours expected from initial warning (v1.6.3+ release pending) |
Implications for African Lightning Infrastructure
LNbits has become a critical middleware component across Sub-Saharan Africa. Self-hosted instances power community micro-payments, merchant point-of-sale setups, tipping bots, and localized circular economy projects across hubs in Nigeria, Kenya, South Africa, Ghana, and East Africa.
Because operators rely on self-hosted servers to preserve operational sovereignty and minimize fees, there is no centralized remote kill switch. Each local business, community hub, or node runner must manually take their server offline to prevent exploitation.
Mandatory Action Plan for Server Operators
All operators running LNbits instances must execute the followiMaintain Shutdown Until Patch Release: Do not restart services until an official patch release (following v1.6.2) is published on the official LNbits GitHub Repository.
Ignore Unofficial Fixes: Avoid applying third-party code modifications, unverified PRs, or instructions shared via direct messages.
Isolate Hot Liquidity: Ensure underlying node RPC admin credentials remain restricted while the application layer is offline.