LNbits Calls for Server Shutdown After Lightning Wallet Attacks

LNbits has told all operators of its open-source Bitcoin Lightning wallet servers to shut them down amid an active wave of attacks. The warning followed a reported theft of 2,285,545 satoshis, approximately 0.023 bitcoin, from one operator’s server before it could be taken offline.

The project initially issued a narrower alert asking operators to disable Paywall, an extension that requires users to pay to view content, while it investigated a potential flaw. Roughly 80 minutes later, LNbits escalated the advice to a full shutdown of LNbits servers.

Fixes were not yet available

As of 09:00 UTC, LNbits had not released a fixed version, withdrawn the shutdown recommendation, or published instructions for determining whether a server had already been affected. Ben Arc, an LNbits developer, said patches should be merged and available within 24 to 48 hours of his update.

LNbits also switched off the instances it operates through its my.lnbits.com cloud service. In a service notice, the project said those hosted services would return within 24 hours, placing the stated target at about 17:20 UTC.

Reported loss and scope of the notice

Kevin Ravensberg, who operates BitTipBot on Telegram, said his server was exploited between 09:22 and 14:00 UTC, beginning more than three hours before LNbits issued its first warning at 12:33 UTC. He said he intends to repay users, but they cannot access their funds until the flaws are resolved.

Ravensberg later said Arc and security testers had confirmed the exact extension exploit used against his server. Neither Ravensberg nor the project had identified that extension publicly by 09:00 UTC, and LNbits had not confirmed whether it was the Paywall add-on mentioned in the initial alert.

Operational boundary for wallet teams

The shutdown notice applies to LNbits servers and does not name Lightning nodes or other wallet software. LNbits has not said how many servers were attacked or disclosed a total amount taken, leaving operators without a published assessment of the broader impact.

For businesses running LNbits, the immediate implication is to follow the shutdown instruction, retain logs and transaction records for investigation, and plan restoration only after the project releases fixes and operators can validate their environments.