LNbits Orders Lightning Wallet Servers Offline After Attacks

LNbits told every lightning wallet operator on Sunday, November 8, 2026, to stop their servers immediately after what the project called a wave of attacks.

The official LNbits account posted the shutdown order at 13:56 UTC. It asked users to forward the announcement, said a number of security patches still needed to be pushed, and added that it was better to err on the side of caution until then.

Earlier that day, at 12:33 UTC, LNbits asked operators to disable the Paywall extension immediately while it investigated a potential bug. By 17:18 UTC, it said it had disabled all instances on its hosted service, my.lnbits.com, as a precaution and expected those services to resume within 24 hours.

This is an emergency around application software that sits on top of Lightning payments, not a failure of Bitcoin’s base-layer settlement rules.

What LNbits Told Lightning Wallet Operators

Ben Arc, a core LNbits contributor, repeated the request minutes later, at 13:59 UTC. He asked people to forward the warning to anyone who might be running an instance and said patches should be merged and available within 24 to 48 hours.

The earlier Paywall message shows the team’s first public step was narrower. At 12:33 UTC, the warning applied only to operators who had that extension enabled. The later all-server shutdown indicated the concern had widened beyond a single optional feature, even though LNbits had not yet published a full list of affected components.

We would not treat those two warnings as proven descriptions of the same exploit. The project said it was investigating a potential bug in the Paywall extension. Separately, it said attacks had prompted a broader set of patches.

What One Operator Reported After the Withdrawals

Kevin Ravensberg wrote that his LNbits instance was exploited before he could take the server down. He said new accounts used the exploit to withdraw 2,285,545 sats between 9:22 and 14:00 UTC on November 8. That amount is 0.02285545 bitcoin, or about $1,733 at Bitcoin’s CoinGecko price of about $75,840, retrieved on November 8, 2026.

Ravensberg said the instance supported BitTipBot, a Telegram tipping service, and that he would make those users whole. He also said they would not be able to access funds until LNbits had patched the vulnerabilities.

He later added that the project’s red team and Ben Arc had confirmed which extension was used, and that work was underway to prevent similar attacks. That account comes from the operator, not from a detailed public incident report by LNbits. We would wait for the project’s own patch notes before treating any single extension as the official root cause.

Those reported withdrawals also echo a point we have made after other application failures, including the Keplr wallet breach and the self-custody questions raised after the Chainalysis incident: software that holds or routes coins can fail even when Bitcoin itself keeps producing blocks.

Why This Does Not Break Bitcoin Itself

LNbits is an open-source accounts and payments layer that typically connects to a Lightning funding source, such as a Lightning node. It can expose wallets, programming interfaces, payment tools, and optional extensions.

Bitcoin settlement does not depend on LNbits remaining online. A holder who controls their own keys can still move coins when the network confirms a transaction. Lightning itself is a second layer built on Bitcoin; LNbits is one software suite that uses that layer.

We believe that distinction should stay in view. An attack on an application is not a reason to doubt Bitcoin’s fixed supply or the durability of its settlement layer. It is a reason to treat hot wallets, public-facing extensions, and hosted balances with more care, as we also noted when we looked at why self-custody can matter during a banking shock.

How Public Lightning Capacity Has Shifted This Year

Sunday’s alert landed against a Lightning Network that, in public data, is smaller in bitcoin terms than it was earlier in 2026.

mempool.space snapshots retrieved on November 8, 2026, show public capacity at about 5,746 bitcoin on January 4, 2026, the highest 2026 print in the series we reviewed. The latest point, dated November 3, 2026, was about 3,195 bitcoin, roughly 44 percent below that early-January snapshot. The same series showed about 28,940 announced public channels on November 3, down from about 42,079 on November 9, 2025.

These figures describe public, announced capacity, not every private channel. The archive has several gaps longer than two weeks, so the charts below break the line rather than invent a smooth path. One May 18 snapshot looked incomplete beside the following day’s print, and we omitted it.

A smaller public Lightning graph does not mean Bitcoin stopped working. Bitcoin was trading near $75,840 on Sunday, according to CoinGecko data retrieved the same evening, with a 24-hour change of about 0.2 percent.

What Operators Should Do Until the Patches Arrive

Operators should keep LNbits servers offline until security patches are released and can be verified. Ben Arc’s 24-to-48-hour window is a timing estimate, not a guarantee. LNbits separately said its hosted service at my.lnbits.com should resume within 24 hours. Those are two different clocks: one for self-hosted operators waiting on patches, and one for the project’s own hosted instances.

Until those updates are out, we would look for official patch notes and verifiable releases, not unofficial rebuilds.

We believe Bitcoin users do not need to confuse this episode with a protocol failure. The constructive response is the one LNbits asked for: take the vulnerable software offline, wait for the patches, and remember that self-custody of bitcoin remains available on the base layer while an application is being repaired.