On November 8, 2026, the maintainers of LNbits, the widely used open-source software package that lets people run Bitcoin Lightning Network wallets and payment tools, issued an urgent instruction for every operator to take their servers offline immediately.
The directive followed a series of reported compromises in which unauthorized parties created accounts on affected installations and moved funds out without permission.
Developers stated they were preparing multiple security fixes and advised operators to remain offline until those updates could be released.
LNbits functions as a modular accounts layer that sits on top of a connected Lightning node (such as LND or Core Lightning).
It enables administrators to spin up multiple wallets, payment links, and add-on extensions for services ranging from tip bots to merchant checkouts.
Because many independent operators run their own instances rather than relying solely on a single hosted service, the project’s warning applied broadly to self-hosted deployments.The response unfolded in stages.
Earlier the same day, the project’s official account first asked operators who had the Paywall extension turned on to disable that feature while a possible issue was examined.
Roughly eighty minutes later the scope expanded.
The team posted that all LNbits users should stop their servers at once, citing a wave of attacks and the need to push security patches.
The message stressed that it was safer to shut down completely than to continue operating while fixes were still being prepared.
A core contributor, Ben Arc, reinforced the alert shortly afterward, noting that patches were expected to be merged and available within 24 to 48 hours and urging people to share the notice with anyone known to run an instance.
As a further precaution, the project also disabled every instance on its own hosted platform, my.lnbits.com, and indicated that those services would be restored within about 24 hours.
⚠️⚠️ All LNbits users should stop their LNbits servers IMMEDIATELY. ⚠️⚠️
Please forward this announcement.
Following a wave of attacks, we have a number of security patches to push. Until then, it's better to err on the side of caution. 🙏
Updates to follow soon.— LNbits (@lnbits) November 8, 2026
No public statement identified the precise vulnerability or vulnerabilities involved, listed affected versions, or published a cumulative loss figure.
The most recent stable release available on the project’s GitHub repository at the time of the alerts remained version 1.6.2, issued in September.
One publicly documented case involved the operator of BitTipBot, a Telegram-based tipping service that relies on an LNbits instance.
That operator reported that newly created accounts had withdrawn approximately 2,285,545 satoshis (roughly 0.0229 bitcoin) over a period of several hours, beginning around 9:22 UTC and continuing until roughly 14:00 UTC.
The operator stated an intention to personally reimburse affected users of the service, while noting that the funds themselves would remain inaccessible until the underlying issues were patched.
Other operators may have been affected as well; because LNbits is self-hosted by many parties, a complete accounting of incidents has not been published by the project.
The incident concerns the application software that manages wallets and extensions on top of the Lightning Network, not the underlying Bitcoin protocol or the Lightning protocol itself.
Operators who followed the instruction were advised to keep servers offline until updated releases and any accompanying security advisories appeared. The project indicated that further updates would follow once the security related patches were ready for distribution.
