LNbits has urged every operator to shut down their server immediately after attackers reportedly compromised multiple instances of the open-source Bitcoin Lightning wallet platform. The project first told operators to disable its Paywall extension while investigating a potential bug, then escalated the warning to a systemwide shutdown as it prepared several security fixes. LNbits’ initial security notice was posted on Nov. 8.
The most detailed public incident report came from Kevin Ravensberg, operator of the BitTipBot service. He said attackers created new accounts on his LNbits instance and withdrew 2,285,545 satoshis—about 0.0229 bitcoin—before he could contain the compromise. The reported theft establishes at least one confirmed loss, but the project has not publicly disclosed a complete victim count, total losses or a named attacker.
The available reporting indicates that the Paywall extension is central to the initial investigation, but LNbits has not publicly published a root-cause analysis, CVE identifier, CVSS score or confirmed affected-version range for this incident. Its public GitHub advisory page currently lists two older high-severity advisories: an SSRF issue identified as GHSA-qp8j-p87f-c8cc, published in April 2025, and an Eclair-backend payment-failure issue identified as GHSA-3j4h-h3fp-vwww, published in June 2024. Neither page identifies the Nov. 8 attack as its associated incident. The LNbits security-advisory page does not currently provide a CVE or CVSS assessment for the newly reported flaw.
That lack of technical detail does not make the warning low risk. An attacker who can create accounts and reach withdrawal functionality on a wallet server may be able to convert an application-layer weakness into an immediate loss of Lightning funds. Because LNbits instances can be connected to operators’ Lightning backends, administrators should treat exposed balances and payment credentials as potentially at risk rather than assuming that only the web interface was affected.
Operators should follow LNbits’ emergency guidance by taking servers offline, disabling the Paywall extension if a full shutdown is not yet possible, and preserving logs and wallet records for investigation. They should not restore service until the project publishes a signed or otherwise verifiable fixed release and explicit recovery instructions. As of Nov. 9, public reports said patches were still being prepared, with contributors indicating that updates could take 24 to 48 hours; no public attribution to a threat actor or exploitation-in-the-wild report from a government authority has been established.
