What happened
On 8 November 2026, LNbits told every operator to stop their server immediately after what the project called a wave of attacks. LNbits is open-source software that lets an operator provide Lightning payment accounts and tools on top of a funding source. The project later disabled its own hosted service while it investigated.
The notice followed an earlier warning about attacks on the LNbits Paywall extension. The project did not say whether the same flaw caused both events, whether the vulnerable code was in the core server or an extension, or which versions were affected.
Kevin R4v, operator of the Bittipbot service, reported that newly created accounts withdrew 2,285,545 sats from his service between 09:22 and 14:00 UTC. A sat is the smallest unit of bitcoin. That is one operator's account of one loss, not a project-wide total.
What it changes
The shutdown turns an uncertain software warning into an operational stop for anyone running LNbits. An operator who follows the project's notice cannot process LNbits payments until a reviewed patch is available and the service is brought back online.
As of the morning of 9 November, the latest published LNbits release was still version 1.6.2 from 18 September. Its notes describe a PostgreSQL backup fix, not this incident. The absence of a newer release means a green version number alone is not evidence that the attack path is closed.
The event also shows where custody can sit in a Lightning service. An LNbits account may look like a wallet to its user, but the operator controls the server and its funding connection. If that server accepts an unauthorized withdrawal, the end user cannot repair it with a Lightning channel backup.
What it does not change
No public evidence shows that Bitcoin or the Lightning protocol itself was broken. The reports concern application software built on Lightning. Other wallets, nodes and services do not automatically share the same code or exposure.
The cause remains unknown. LNbits has not published an advisory, patch, affected-version range, victim count or total loss. The Paywall warning may be related, but the project has not confirmed that link. It has also not named the extension that the Bittipbot operator said was exploited.
The reported 2,285,545 sats should not be treated as the total stolen. It is a first-hand claim from one operator. Until LNbits publishes a technical account, the number of affected servers and whether attackers used one flaw or several remain open questions.
Context
Three independent newsrooms reported the shutdown on 8 November. TFTC documented the all-server order and the operator's withdrawal report. Bitcoin.com News separated the official shutdown from what was still unknown about the exploit. CyberSIXT reconstructed the warning, shutdown and hosted-service suspension from the project's notices.
All three agree on the emergency stop and the single operator's loss report. None provides an independently verified project-wide loss total or a technical explanation of the exploit. The safest conclusion is narrow: LNbits found the risk serious enough to tell every operator to go offline, while the mechanism and scope are still unresolved.