Image Credit: lnbits.com
- LNbits operators awaited a security release over a day after shutdown instructions.
- The LNbits team instructed all server operators to stop their servers immediately.
- Operator Kevin Ravensberg reported unauthorized withdrawals totaling 2,285,545 satoshis from his instance.
LNbits operators were still waiting for a published security release on Nov. 9, more than a day after the Bitcoin Lightning payments software’s maintainers told them to shut down their servers.
At 14:46 UTC, its official GitHub release history still listed v1.6.2, a September database-backup hotfix, as the latest version. On its release and security-advisory pages, no incident-specific release or restart protocol surfaced.
Shutdown Warning Expanded Beyond the Paywall Extension
LNbits first asked operators to disable its Paywall extension at 12:33 UTC on Nov. 8 while it investigated a possible bug. At 13:56 UTC, it broadened the warning to everyone running an LNbits server. The LNbits team instructed operators:
“All LNbits users should stop their LNbits servers IMMEDIATELY.”
The team said it had several security patches to prepare following a wave of attacks. Its shutdown instruction did not identify a safe version or limit the request to particular server configurations.
LNbits also disabled all instances on its own hosted service, my.lnbits.com, as a precaution later that day. It announced an expected restoration within 24 hours, putting that target on Nov. 9.
In a separate incident earlier this month, BTCPay Server also asked operators to take their servers offline while investigating wallet thefts.
September’s Backup Hotfix Predates the Attacks
Version 1.6.2 was published on Sept. 18 and addressed PostgreSQL backups. Its release notes do not identify it as a fix for the November attacks, despite GitHub continuing to display it as the latest release.
The repository’s advisory page contained two older disclosures, published in April 2025 and June 2024. Neither addressed the current incident.
LNbits contributor Ben Arc outlined the expected patch timing in a Nov. 8 post:
“Patches should be merged and available within 24-48hrs.”
One Operator Reports Well Over 2 Million Satoshis Withdrawn
Operator Kevin Ravensberg reported that newly created accounts withdrew 2,285,545 satoshis, approximately 0.0229 Bitcoin, from his LNbits instance before he could stop the server.
He placed the attack between 09:22 and 14:00 UTC on Nov. 8, starting before either public warning. In a later update, he said Ben Arc and security testers had identified the extension exploit used against his server, without naming the extension.
LNbits supports wallets and applications such as merchant checkouts, tipping tools and payment services. Ravensberg said BitTipBot users could not access their funds until the vulnerabilities were patched and pledged to reimburse them.
