LNbits Servers Urged Offline Due to Lightning Vulnerability

Emergency Shutdown Warning Issued for LNbits Platform

Developers behind the open-source Lightning Network platform LNbits issued an urgent warning on Sunday, Nov 8, 2026. They asked all server operators to turn off their running instances immediately.

The development team made this call after detecting multiple security compromises across the network. Rather than letting node runners wait for scheduled maintenance, developers urged an immediate shutdown to protect user assets.

The core announcement posted at 13:56 UTC advised everyone to err on the side of caution. Core contributor Ben Arc noted that official security patches should become available within 24 to 48 hours.

Earlier that day at 12:33 UTC, developers had initially requested operators to disable the Paywall extension. However, as broader issues emerged, LNbits also suspended its hosted platform service at my.lnbits.com.

Attackers Drain Satoshis from Telegram Tipping Bot

The real-world impact of the vulnerability surfaced quickly through individual server operators. Dutch operator Kevin Ravensberg shared details regarding an attack on his Telegram tipping service, Bittipbot.

Between 9:22 AM and 2:00 PM UTC on Nov 8, attackers created unauthorized accounts on his LNbits setup. They managed to drain 2,285,545 satoshis, which equals roughly 0.02285545 BTCBTC+0.26%.

Ravensberg announced he would personally reimburse affected Bittipbot users. However, fund access remains frozen until developers fix the security flaw.

Understanding LNbits Architecture and Risk Factors

LNbits functions as a modular accounting system connected to underlying Bitcoin Lightning nodes such as LND and Core Lightning. It lets users create separate wallets, payment terminals, APIs, and custom extensions.

While this setup offers great flexibility for merchants and developers, it also adds software layers. If web-facing extensions contain authorization bugs, attackers can exploit them to move funds without permission.

Earlier in 2026, security firm V12 audited LNbits and found an authentication-cache bypass along with a PayPal integration flaw. Developers patched those issues in version 1.6.0, though experts haven't linked them to this latest breach.

Wider Security Challenges Across the Lightning Ecosystem

This incident highlights a demanding year for broader Lightning Network infrastructure. Multiple major implementations have required critical fixes during 2026:

• Core Lightning: In August, maintainers addressed AI-assisted bug reports, leading roughly 22% of nodes to temporarily go offline.
• Lightning Development Kit (LDK): Developers patched a dangerous reconnect flaw that could make nodes sign conflicting commitment transactions.
• Eclair & Core Lightning: September and October updates tackled denial-of-service vulnerabilities, channel-closing flaws, and memory exhaustion bugs.

Additionally, public network data from newhedge.io reveals that the Lightning Network has lost over 1,100 BTC in total capacity since late July. This decline places total capacity back to levels seen in mid-2022.

Past performance of digital assets and network metrics is not indicative of future results. Operating self-hosted nodes carries inherent technical and software security risks.

Next Steps for LNbits Node Operators

For now, the recommendation for LNbits server managers remains clear: keep all server instances offline until official software patches are released and audited.

This emergency serves as a reminder that layer-2 software security requires constant vigilance. Even if the base payment network is stable, third-party management tools can introduce vulnerable access points.