LNbits said on Sunday, Nov. 8, that it had switched off every instance on its hosted service as a precaution. Earlier on Sunday, the team had told all users to stop their LNbits servers after what it called “a wave of attacks.” LNbits makes open-source Bitcoin Lightning payments software. It has not disclosed how the attacks worked, which versions are affected, or whether any funds were lost.
Three warnings in one day
The project’s public guidance widened over about five hours on Sunday, Nov. 8. The timing matters because each step changed what operators were being asked to do.
At 12:33 UTC, LNbits posted a security precaution for all operators: “If you are have the Paywall extension enabled, please disable it IMMEDIATELY, while we investigate a potential bug.” At that stage, the warning covered one optional extension.
At 13:56 UTC, the scope widened to every server. “All LNbits users should stop their LNbits servers IMMEDIATELY,” the team said. “Following a wave of attacks, we have a number of security patches to push. Until then, it’s better to err on the side of caution.” It said updates would follow soon.
At 17:18 UTC, LNbits said it had taken its own managed service offline. “As a precaution we have disabled all instances on our saas,” it wrote, adding: “All services will be resumed with 24hrs.”
Hosted service versus self-hosted servers
LNbits can run in two ways, and the latest step applies only to one of them. According to its website, LNbits is a modular payments platform. It combines a wallet and accounts system, an extension store and an API, and works with “ANY Lightning funding source.” Users can run it themselves, including on a plug-and-play “LNbits Box,” or use LNbits Hosted, a fully managed version.
The Sunday evening shutdown covers the hosted platform that the LNbits team operates. The shutdown is reported by LNbits; AltcoinReporter has not independently tested hosted-service availability. Self-hosted servers are run by their owners. For those operators, the guidance is the earlier request to stop servers until patches are released.
Neither notice says that every deployment was compromised. LNbits described the hosted shutdown as a precaution. The stop-server request was also framed as caution while patches are prepared, not as confirmation that each server had been breached.
The notices do not identify a vulnerability in the Bitcoin network or the Lightning protocol itself. LNbits is application software that sits on top of a Lightning node or funding source. Its warnings concern LNbits servers and, at first, a single extension.
What is still unknown
LNbits has not said what the attacks targeted or how they worked. The Paywall extension was the subject of the first warning, but the team described that only as “a potential bug” under investigation. It has not been named as the cause of the wider attacks.
The official notices checked for this article disclose no loss figure, count of affected servers or victims, or affected version range. The team said it has “a number of security patches to push,” but AltcoinReporter found no incident-related patched release on its public GitHub releases page at the time of checking. The latest release listed on the project’s GitHub releases page is v1.6.2, from Sept. 18, a hotfix for a database backup feature. AltcoinReporter found no new security advisory on the repository tied to Sunday’s attacks.
The 24-hour timeline for restoring hosted instances is the team’s stated expectation. LNbits has not said what conditions must be met before it brings the service back, and has not said when self-hosted operators should restart.
Why operators are affected
LNbits is used for point-of-sale systems, online checkout and donation buttons, paywalls, tipping, vending machines and API-driven apps, according to its website. Stopping a server takes those payment flows offline until it is restarted. Merchants and developers who rely on the hosted service lose them for the duration of the suspension.
The incident follows a separate one at another open-source Bitcoin payments project. Earlier this month, BTCPay Server said hot-wallet sweeps hit servers running version 2.4.1 or older. Nothing published so far links the two incidents.
FAQ
Is the Lightning Network affected? No evidence suggests that. LNbits’ warnings concern its own application software and hosted service, not the Bitcoin or Lightning protocols.
Were funds stolen from LNbits users? LNbits has not published any loss figure or said how many servers were affected. It has described its actions as precautions following a wave of attacks.
When will LNbits Hosted come back? LNbits said it expected all services to resume within 24 hours; that is not confirmed restoration. The official posts and public repository pages checked for this article provided no incident-related patch version or safe-restart guidance for self-hosted operators.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
