LNbits tells operators to shut down servers after reported account exploits
In brief
- LNbits asked every user to shut down their servers on November 8, 2026.
- Attackers reportedly opened new accounts on LNbits instances and withdrew funds without permission.
- BitTipBot's operator reported losing about 2,285,545 sats, roughly 0.0229 BTC.
- LNbits said it expects to release multiple security patches within 24 to 48 hours.
What operators reported
The clearest public case came from BitTipBot. Its operator, who posts as @KevinR4v, reported losing approximately 2,285,545 sats (about 0.0229 BTC). A sat is the smallest unit of Bitcoin, one hundred-millionth of a coin. By the operator's own account, the attack ran for about five hours, starting at approximately 9:22 UTC and continuing to around 14:00 UTC.
The operator said they're committed to reimbursing affected users. That won't happen right away (BitTipBot's funds remain inaccessible until the security patches are applied).
Why every server has to act
LNbits is a self-hosted layer that sits on top of the Lightning Network, letting users manage multiple wallets and accounts. Operators use it to build tip bots, point-of-sale setups and shared group wallets without handing custody to a large company.
That design cuts both ways.
So why can't LNbits just push a fix to everyone? There's no central switch the project can flip to protect every instance. Each operator runs their own server and has to act individually, which is why LNbits asked the community to spread the advisory as widely as possible.
Patches and context
LNbits said it's working on multiple security patches and expects to release them within 24 to 48 hours of the warning, Crypto Briefing reported. Earlier vulnerabilities were fixed in September 2026 with version 1.6.0, which followed an audit by V12.
Electrum and Core Lightning also rolled out their own security updates in early November. Crypto Briefing said no link between those updates and the LNbits vulnerabilities has been confirmed.
No immediate market reaction has been observed, and the losses reported so far are small in Bitcoin terms.
Frequently asked questions
What is LNbits?
LNbits is open-source software used to run Bitcoin Lightning Network wallets. It's a self-hosted layer on top of the Lightning Network that lets users manage multiple wallets and accounts. Operators use it for tip bots, point-of-sale setups and shared group wallets without handing custody to a large company.
Why did LNbits ask users to shut down their servers?
LNbits issued the warning on November 8, 2026, after multiple reports that attackers were creating new accounts on LNbits instances and withdrawing funds without permission. The project said it's working on multiple security patches and expects to release them within 24 to 48 hours of the warning.
Why can't LNbits fix every server at once?
There's no central switch LNbits can flip to protect every instance. Each operator runs their own server, so each one has to act individually. That's why LNbits asked the community to spread the advisory as widely as possible.
