LNbits tells operators to shut down after reported wallet drains

On November 8, 2026, LNbits told every operator of its open-source Bitcoin Lightning wallet software to shut down their servers after BitTipBot operator @KevinR4v reported losing approximately 2,285,545 sats. The loss equals about 0.0229 BTC. Attackers reportedly opened fresh accounts on LNbits instances and withdrew funds they had no right to touch.

What happened at BitTipBot?

Reports described a string of successful exploits in which attackers created new accounts and withdrew unauthorized funds. One sat equals one hundred-millionth of a bitcoin, and Lightning users commonly quote payments in sats because the network targets small, fast transfers.

The attack reportedly lasted roughly five hours, from approximately 09:22 UTC to 14:00 UTC. The source did not disclose the technical attack vector or how many LNbits instances were affected.

@KevinR4v said they were committed to reimbursing affected users. The report said the funds would remain inaccessible until the patches were applied, so users had to wait on LNbits before they could be made whole. In short, reimbursement cannot begin until the wallet software is fixed and applied.

Why could LNbits not protect every instance itself?

LNbits lets operators manage multiple wallets and accounts in a self-hosted layer on top of the Bitcoin Lightning Network. Operators can use it for tip bots, point-of-sale systems, or shared group wallets without giving custody to a large company.

That architecture leaves each operator responsible for applying the advisory. LNbits cannot use one central switch to protect every instance, so it asked the community to spread the warning widely.

LNbits put its instruction plainly: “Turn it off, wait for the fix, and tell everyone you know who runs it to do the same.” Until operators receive and act on the warning, no central response can close the exposed servers.

When can operators restore service?

After ordering the shutdown, LNbits said it was preparing multiple security patches. It expected to release them within 24 to 48 hours of the November 8 warning, a window of roughly one to two days. That timeline remained a project estimate rather than a guaranteed release time.

The project had addressed earlier vulnerabilities in September 2026 through version 1.6.0, released after an audit by V12. That history shows repeated security work, although the source did not establish that the September fixes and the reported account exploit shared a root cause.

The source also noted security updates from other Lightning-related projects, including Electrum and Core Lightning, in early November 2026. No specific link between those updates and the LNbits vulnerabilities had been confirmed.

Users therefore have no basis to treat the other projects' releases as evidence of a common cause. The practical checkpoint is LNbits' own promised patch set.

Who bears the operational cost?

The reported BitTipBot loss creates a specific problem: the operator has promised reimbursement but cannot deliver it while the required software remains vulnerable and offline. End users remain in limbo through no fault of their own, according to the source's assessment.

The source reported no immediate market reaction and described the losses as small in Bitcoin terms. It also distinguished this incident from a major exchange or custodian breach because the affected system was a self-hosted tool.

The next verifiable checkpoint is the promised patch release within 24 to 48 hours. Until operators install an effective fix, BitTipBot users remain without a functioning service or the reimbursement their operator has promised.