LNbits Urges Server Shutdown After Reported Wallet Attacks

LNbits told all operators to "take their servers offline" at 8:56 a.m. ET (13:56 UTC) on Sunday, Nov. 8, after a wave of reported attacks, according to its shutdown notice. One operator, Kevin Ravensberg, said attackers withdrew 2,285,545 satoshis from his LNbits instance.

The platform said emergency security patches were in preparation, but the notice gave no release time or affected-version list. About 80 minutes earlier, LNbits had directed users to "disable the Paywall extension."

What does the reported loss establish?

Ravensberg, who operates the Telegram tipping service Bittipbot, said attackers created new accounts on his LNbits instance. He reported a withdrawal of 2,285,545 satoshis (0.02285545 BTC) between 4:22 and 9 a.m. ET (09:22 to 14:00 UTC) on Nov. 8. That 4-hour, 38-minute window provides timing, but his account includes no transaction identifiers or on-chain analysis.

The amount equals about 2.29% of one bitcoin, since one bitcoin contains 100 million satoshis. It should be treated as one operator's reported loss, not a total for the campaign. The material did not explain how attackers created the accounts or which component ultimately released the funds.

For now, the loss remains a single named operator's account rather than an incident-wide accounting.

What does the shutdown actually tell operators?

The platform's broad instruction did not come with a diagnosis. The sequence documents a response escalation, not a proven causal chain. Nothing in the notice established that the Paywall extension caused the reported withdrawals or that disabling it would have prevented the losses.

LNbits runs on top of a Lightning funding source and provides wallet and payment tools. For operators, the relevant control point is the LNbits deployment that processed the accounts and withdrawals. The material does not assign responsibility to the funding source, and it does not describe whether the funds moved through LNbits or another component.

The immediate containment step was clear; the security diagnosis was not.

What remains undisclosed?

The shutdown message did not identify affected software versions, the number of affected servers, or an incident-wide loss total. Each omission limits a different part of the assessment. Without version boundaries, operators cannot determine from the notice alone whether their installations are affected. Without a server count, the scale of affected deployments remains unquantified.

As of 2:21 p.m. ET on Monday, Nov. 9, LNbits' latest listed software release remained version 1.6.2, dated Sept. 18. Listing that version does not identify it as vulnerable.

The notice set no date for emergency patches. No patch deadline or restoration schedule was provided.

The notice establishes urgency without establishing a complete scope.

What should operators watch next?

The next test is a version-specific advisory paired with a usable patch, not a general assurance that service will resume. Operators will need to know which deployments require action and whether the reported account-creation and withdrawal path has been closed. Those are verification requirements, not commitments made in the shutdown notice.

Until LNbits supplies those details, taking servers offline remains the clearest containment instruction available. Operators otherwise face a service-restoration decision without knowing which deployments require changes.

The next checkpoint is a dated patch and an affected-version list.