---
title: Hunt: new LNbits accounts followed by unexpected withdrawals on internet-facing instances | ctxsec
url: https://ctxsec.com/items/hunt-lnbits-new-accounts-unexpected-withdrawals-nov-8
description: "LNbits has not published exploit details, but one operator reported that attackers created new accounts and withdrew funds for several hours before the project told everyone to shut down. If you ran an instance that was reachable from the internet, look for that pattern in logs and the admin UI before you restart."
status: "hunt idea from LNbits official warning and one operator report (Nov 8); no project-published IOC list yet"
published: 2026-11-08
---

> LNbits has not published exploit details, but one operator reported that attackers created new accounts and withdrew funds for several hours before the project told everyone to shut down. If you ran an instance that was reachable from the internet, look for that pattern in logs and the admin UI before you restart.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-lnbits-new-accounts-unexpected-withdrawals-nov-8.md)

hunt idea from LNbits official warning and one operator report (Nov 8); no project-published IOC list yet

2026-11-08

### Hunt: new LNbits accounts followed by unexpected withdrawals on internet-facing instances

- List LNbits user accounts created on Nov 8 (one reported window was 9:22 a.m. to 2:00 p.m. UTC) and any withdrawals those accounts made.
- Check whether the LNbits web UI or API was reachable without an allowlist or VPN, and whether the Paywall extension was enabled before the first warning.
- After you apply official patches, rotate API keys and node admin credentials the web app could read, then watch for further account-creation or withdrawal spikes.

Sources: [LNbits shutdown notice (Nov 8)](https://x.com/lnbits/status/2119428804951048237) · [Kevin Ravensberg operator report](https://x.com/KevinR4v/status/2119452284996243914)