---
title: LNbits tells every operator to stop their servers immediately after a wave of attacks; patches are not out yet | ctxsec
url: https://ctxsec.com/items/lnbits-stop-all-servers-immediately-wave-of-attacks-nov-8
description: "The open-source Lightning Network wallet project LNbits posted on Nov 8 at 8:56 a.m. ET that all users should stop their LNbits servers immediately following a wave of attacks, asked people to forward the warning, and said it has several security patches to ship. About 80 minutes earlier it had told operators to disable the Paywall extension at once while it investigated a potential bug; the later post covers every LNbits server, not only that extension. The project has not yet published a CVE, a technical root cause or a confirmed total stolen. Operator Kevin Ravensberg wrote that his instance was exploited before the shutdown notice: newly created accounts withdrew 2,285,545 sats between 9:22 a.m. and 2:00 p.m. UTC, and he said he would make BitTipBot users whole once a patch is available."
status: "official (@lnbits, Nov 8); one operator reported losses on their own instance; no CVE or root cause published yet"
published: 2026-11-08
---

> The open-source Lightning Network wallet project LNbits posted on Nov 8 at 8:56 a.m. ET that all users should stop their LNbits servers immediately following a wave of attacks, asked people to forward the warning, and said it has several security patches to ship. About 80 minutes earlier it had told operators to disable the Paywall extension at once while it investigated a potential bug; the later post covers every LNbits server, not only that extension. The project has not yet published a CVE, a technical root cause or a confirmed total stolen. Operator Kevin Ravensberg wrote that his instance was exploited before the shutdown notice: newly created accounts withdrew 2,285,545 sats between 9:22 a.m. and 2:00 p.m. UTC, and he said he would make BitTipBot users whole once a patch is available.

[← Cybersecurity News](/news) · [markdown](/items/lnbits-stop-all-servers-immediately-wave-of-attacks-nov-8.md)

official (@lnbits, Nov 8); one operator reported losses on their own instance; no CVE or root cause published yet

2026-11-08

### LNbits tells every operator to stop their servers immediately after a wave of attacks; patches are not out yet

- **Do now (per LNbits):** stop the LNbits process and leave it off until the project publishes patches through its official channels.
- The earlier Paywall-only precaution is superseded by the full shutdown request.
- This is an LNbits application warning, not a Bitcoin or Lightning protocol failure. Isolate the node's admin credentials (for example LND/CLN macaroons) from the stopped web app, and do not point a public URL at LNbits again until you have applied the official updates and reviewed accounts created around the attack window.

Sources: [LNbits: stop all servers immediately (Nov 8)](https://x.com/lnbits/status/2119428804951048237) · [LNbits: disable the Paywall extension (earlier Nov 8)](https://x.com/lnbits/status/2119408009700937798) · [Kevin Ravensberg: 2,285,545 sats withdrawn from his instance via new accounts](https://x.com/KevinR4v/status/2119452284996243914)