LNbits urges users to stop servers, disables hosted service after attacks
In brief
- LNbits asked all users to stop their LNbits servers after reporting a wave of attacks.
- LNbits disabled all hosted instances on Nov. 8 and estimated a 24-hour restoration.
- Pull request #4310 merged into development on Nov. 9 but isn't a stable release.
- GitHub still listed v1.6.2, a September backup hotfix, as the latest stable release.
What LNbits said
LNbits said it had security patches to push and would provide further updates. That's about all the detail it gave. Both the shutdown request and the hosted-service move came from the project's own @lnbits notices, as reported by CryptoSlate, and the 24-hour restoration window was LNbits' estimate rather than a commitment.
Neither notice announced restart clearance. As of CryptoSlate's review (public material as of about 18:20 UTC on Nov. 9), no all-clear was visible on LNbits' public timeline.
A development merge isn't a release
LNbits merged pull request #4310 into its development branch on Nov. 9. The change descriptions cover stronger request protections, blocking the server from making requests to itself, and disabling new-account creation by default.
It's not the stable build, though. GitHub's latest-release API still identified v1.6.2 as LNbits' latest stable release at the time of that Nov. 9 check, and v1.6.2 was published Sept. 18 with release notes describing a PostgreSQL backup hotfix. CryptoSlate said PR #4310 isn't established as the remedy for the attacks, and noted that a development merge isn't a stable security release or restart clearance.
So operators are still waiting on two separate answers.
Who's affected
LNbits' product description lists point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts and APIs. It supports both self-hosted and managed deployments over underlying Lightning funding sources, and CryptoSlate said stopping those servers can interrupt payment, checkout and tipping services while operators await security fixes and clear restart guidance.
The burden isn't split evenly. Self-hosted operators were asked to stop the instances they run themselves; hosted customers depend on the provider's action (which LNbits said it had already taken).
CryptoSlate framed the open questions this way: which released version addresses the incident, and when will the project explicitly clear servers to restart? As of the Nov. 9 check, LNbits hadn't publicly answered either one.
Frequently asked questions
Is it safe to restart an LNbits server now?
LNbits hadn't announced restart clearance as of CryptoSlate's review at about 18:20 UTC on Nov. 9, 2026. Neither of its two notices cleared servers to restart, and no all-clear was visible on its public timeline.
Is pull request #4310 the fix for the LNbits attacks?
Not established. PR #4310 was merged into LNbits' development branch on Nov. 9, but CryptoSlate said it isn't established as the remedy for the attacks. A development merge isn't a stable security release, and GitHub still listed v1.6.2, a September PostgreSQL backup hotfix, as the latest stable release.
What's the difference for hosted and self-hosted LNbits users?
Self-hosted operators were asked to stop the LNbits instances they run. Hosted customers depend on the provider's action, and LNbits said it had already disabled all hosted instances as a precaution, estimating that services would resume within 24 hours.
