If you run an LNbits server, stop what you are doing and turn it off. On Sunday, November 8, the project behind the free, open-source Bitcoin Lightning wallet system told every operator to shut down their servers immediately, after what it called a wave of attacks. Two days later the warning is still in force, with no stable security release, no public explanation of the flaw, and no all-clear from the project. What has shown up so far is a test package not meant for production use, which is not a fix.
What happened on Sunday
The first sign of trouble came at about 12:33 UTC on Sunday, when LNbits told operators to disable its Paywall extension while it looked into a possible bug. Paywall is an add-on that charges people before they can see content, and at that point the warning looked narrow. About 80 minutes later the project widened it to every LNbits server, telling all users to stop their servers immediately, saying it had a number of security patches to push. The project also switched off its own hosted service, my.lnbits.com, promising it back within 24 hours, a target of about 17:20 UTC on Monday that came and went with no restoration notice. The escalation tells its own story: whatever the attackers found, it was not confined to one extension.
The clearest confirmed loss comes from Kevin Ravensberg, who runs the BitTipBot tipping service on Telegram. Attackers created new accounts on his LNbits server and withdrew 2,285,545 satoshis, about 0.023 bitcoin or roughly $1,700 at Sunday prices, between 09:22 and 14:00 UTC on November 8. So the attack ran for more than three hours before the first warning, and was still going when the shutdown notice landed. Ravensberg has said he will reimburse affected users himself, though the funds are frozen while the incident is sorted out. LNbits has not said how many servers were hit or how much was taken in total, and that number may never be public.
The patch is late, and the test build is not the fix
LNbits developer Ben Arc estimated on Sunday that patches should be merged and available within 24 to 48 hours, putting the expected arrival between Monday afternoon and about 14:00 UTC today. That window has now closed. What has actually appeared is a pair of security changes merged into the development branch on November 9, numbered 4310 and 4313, which tighten request forgery protection and switch off new account creation by default. A test package, version 1.7.0rc4, reached PyPI at 01:51 UTC today, after an earlier release candidate yesterday. But PyPI labels it a prerelease, still being checked before a stable release, and GitHub still lists v1.6.2 from September 18 as the latest stable version. A development merge and a release candidate are progress, but neither is a patched release operators can install and trust.
The project has not published a CVE identifier or an affected-version range, and has not publicly named the flaw or the extension that was exploited. Ravensberg has said developers confirmed which extension was used against his server, but neither he nor the project has named it in public. That leaves operators guessing whether their own setup was exposed, which is exactly the uncertainty that makes a shutdown notice the right call even when it hurts. LNbits is the accounts layer behind tipping bots, payment terminals and small checkout services, so every hour it stays down is an hour those services cannot move money.
What this does and does not mean
The shutdown notice covers LNbits servers only. It does not cover Lightning nodes, and it does not mean the Lightning Network itself is broken. The attacks hit account creation and withdrawal in LNbits, not the LND or Core Lightning software underneath it, and your regular Lightning wallet is a different thing from an LNbits server. That distinction matters, because a scare like this can convince people the whole network is unsafe when the problem is one piece of software that sits on top of it. LNbits shipped a security release in September after an audit by V12, so this is not a project that ignores security, but audits do not catch everything.
If you run an LNbits server, keep it off until the project publishes a stable patched release and says operators can restart, and trust only its official channels on that. Do not restart on a release candidate, and check your balances before you let users back in. The uncomfortable part is the timeline: the attack ran for hours before anyone was warned, and two days later the fix is still a test build. Open-source wallet software runs on trust, earned by shipping the patch, naming the flaw, and saying plainly who was affected. LNbits has not done that yet.
-------
Author: Rowan Marrow
Seattle Newsroom
GlobalCryptoPress | Breaking Crypto News
Bengali (Bangladesh) · 
English (United States) ·