LNbits tells operators to shut down servers after unauthorized withdrawals
The open-source Lightning wallet project issued an emergency warning on November 8 after attackers drained funds from at least one instance.
LNbits, an open-source toolkit for running Lightning Network wallets and payment services, told all operators to switch off their servers on Sunday, November 8. The warning came after attackers created accounts on LNbits instances and withdrew funds without permission.
The project posted on X at about 13:56 UTC that "All LNbits users should stop their LNbits servers IMMEDIATELY," according to Bitcoin.com News and TFTC.
How the day unfolded
- 9:22 to 14:00 UTC: attackers drained the Bittipbot tipping service, according to its operator
- 12:33 UTC: LNbits told operators to disable its Paywall extension while it checked a possible flaw
- About 13:56 UTC: LNbits told every user to stop their servers
- Same day: LNbits disabled all instances on its hosted service as a precaution, CryptoSlate reported
Bittipbot operator Kevin Ravensberg reported losing 2,285,545 satoshis, about 0.023 BTC. He pledged to reimburse his users. No total loss figure across all affected instances has been published.
Patch status
Core contributor Ben Arc said fixes were expected within 24 to 48 hours of the warning, Bitcoin.com News reported. The exact flaw had not been disclosed. TFTC said it was unclear whether the problem sat in LNbits' core account system or in an extension.
As of the evening of November 9, CryptoSlate found no new stable release on GitHub. The latest was v1.6.2, published September 18. A code change merged into the development branch that day disables new account creation by default and adds protection against server-side request forgery.
CryptoSlate said it was not established that this change fixes the attack. No all-clear to restart servers had been issued at the time of its check.
Earlier fixes
LNbits shipped a security release, v1.6.0, in September after an audit by the firm V12. Bitcoin.com News said there is no established link between those earlier issues and this attack.
What operators were told
Self-hosted operators were told to keep their servers offline until patches are released and verified. TFTC said operators should check the official @lnbits account for updates before restarting.
Because each operator runs a separate copy of the software, LNbits cannot switch off vulnerable instances itself. Every operator has to act on the warning individually.
Lightning lets people send small bitcoin payments quickly and cheaply, and LNbits is a popular way for shops and hobbyists to run Lightning services. Bitcoin itself was not affected. The incident shows that funds kept on an internet-connected server carry more risk than coins held in cold storage.
Not financial advice.