---
title: Tip: if you run LNbits, power it off now, isolate the node's spend credentials, and wait for the official patches | ctxsec
url: https://ctxsec.com/items/tip-lnbits-operators-power-off-isolate-node-credentials
description: "LNbits asked every operator to stop their servers after a wave of attacks and said patches are still being prepared. Treat any internet-facing LNbits UI as unsafe until those updates land."
status: "operational guidance (LNbits official posts, Nov 8)"
published: 2026-11-08
---

> LNbits asked every operator to stop their servers after a wave of attacks and said patches are still being prepared. Treat any internet-facing LNbits UI as unsafe until those updates land.

[← Tips & Guides](/tips) · [markdown](/items/tip-lnbits-operators-power-off-isolate-node-credentials.md)

operational guidance (LNbits official posts, Nov 8)

2026-11-08

### Tip: if you run LNbits, power it off now, isolate the node's spend credentials, and wait for the official patches

- Stop the LNbits service (and any reverse proxy that publishes it) rather than only turning off the Paywall extension.
- Keep the underlying Lightning node's admin macaroons or equivalent spend keys off the stopped web app, and review new accounts plus unexpected withdrawals before you bring it back.
- Get updates only from official LNbits channels; ignore unsolicited "recovery" or patch-download links.

Sources: [LNbits shutdown notice (Nov 8)](https://x.com/lnbits/status/2119428804951048237)