LNbits Tells Operators to Shut Down After Attacks
LNbits told every operator to stop their Lightning servers after attackers drained funds. What's known, what isn't, and what to do now.
If you run an LNbits server, the project's advice since Sunday is blunt: switch it off. On 8 November the team behind the open-source Lightning Network wallet and accounts system told every operator to stop their LNbits instances "IMMEDIATELY" after a wave of attacks drained funds from at least one server. As of early 9 November (IST), no patched release has been published.
What happened
The warnings came in steps on LNbits' own X account. At 12:33 UTC (6:03 PM IST) it asked operators to disable the Paywall extension while it looked into a possible bug. About 80 minutes later, at 13:56 UTC, it widened that to every server: "Following a wave of attacks, we have a number of security patches to push. Until then, it's better to err on the side of caution." Core contributor Ben Arc said the fixes should land within 24 to 48 hours. At 17:18 UTC LNbits disabled every instance on its hosted service, my.lnbits.com, and said services would be back within 24 hours.
The clearest damage report comes from Kevin Ravensberg, who runs the LNbits instance behind the Telegram tipping bot BitTipBot. He says newly created accounts withdrew 2,285,545 sats, roughly 0.023 BTC, between about 09:22 and 14:00 UTC, before he could stop his server. He's promised to make his users whole. Bitcoin.com News and Cybersixt have the timeline, and Cybersixt reports he later said LNbits had confirmed which extension was used against him, without naming it.
What we still don't know
Quite a lot. LNbits hasn't said what the flaws are, whether the Paywall bug is one of them, how many instances were hit, or how much was taken in total. The LNbits GitHub releases page still lists v1.6.2 from 18 September as the newest version, and there's no new security advisory or CVE yet. I'm not going to guess at totals that nobody has published.
Why it matters
LNbits sits on top of a Lightning node and hands out separate wallets to lots of users, with add-ons for paywalls, tipping, point-of-sale and more. That's why it's popular with tip bots, small shops and community wallets. It's also why a bug in LNbits matters: the app has a direct line to the money in the node behind it. Bitcoin and Lightning themselves aren't broken here. The problem is the app layer that decides who's allowed to spend.
My take: what to do right now
If you're an operator, this is one of those rare cases where the safe move is also the simple one.
- Keep the server off. Don't just disable Paywall. The project widened its warning on purpose, so treat every extension as suspect until patches ship.
- Check your node, not just LNbits. Look at outgoing payments on the node or funding source behind your instance since at least 8 November, and look for accounts or wallets you didn't create.
- Only update from the official repo. When the fix lands it'll be on LNbits' GitHub and X. Ignore "patched builds" passed around in Telegram groups or DMs. Scammers love a panic like this.
- Shrink your hot balance. Leave only what you need for day-to-day payments on the node and move the rest to cold storage.
If you just hold sats in a wallet someone else runs on LNbits (a tip bot, a community wallet, a shop), you can't do much besides waiting and asking the operator whether they were hit. Don't hand over your login or seed to anyone offering to "recover" funds.
This lands right after the Keplr social-login wallet breach, and the lesson is similar. Any service that holds the keys for you is only as safe as its code. If you're thinking about moving to a hardware wallet, read our Trezor implant warning before you buy one second-hand. I'll update this post when LNbits ships a fixed release and says what went wrong.
Comments ()