LNbits tells every operator to shut down after wave of account-abuse attacks

LNbits, the open-source Lightning accounts server widely used to run Bitcoin tipping bots, point-of-sale front-ends and custodial wallets for small communities, told every operator to shut down their instances immediately on November 8, 2026. The project also pulled its hosted instances offline. According to Crypto Briefing, attackers were opening fresh accounts on live LNbits deployments and withdrawing funds they had no legitimate claim to. Contributor Ben Arc said patches should land within 24 to 48 hours of the advisory, as reported by The Defiant.

What happened

LNbits' architecture gives each tenant an in-server account with a Lightning balance backed by the operator's own node. The attackers, per Crypto Briefing's writeup, did not need to break the node — they used the account layer: open a new account on a running LNbits instance, then move funds out through an LNbits-mediated Lightning payment. The advisory asks operators to stop the service so attackers cannot keep draining accounts while fixes are prepared, and so the patches can be applied before instances come back up.

LNbits did not publish a GitHub Security Advisory for the issue at time of writing — the project's advisories page still lists only GHSA-qp8j-p87f-c8cc (April 2025) and GHSA-3j4h-h3fp-vwww (June 2024), neither related to this incident.

The confirmed loss so far

Only one operator loss is attested on the record. Crypto Briefing cites BitTipBot operator @KevinR4v, who reported losing ~2,285,545 sats (~0.0229 BTC) in a drain that ran from roughly 09:22 UTC to 14:00 UTC on November 8. The project has not published a running total across instances, and because every LNbits deployment is self-hosted, no central party has that number.

- Confirmed loss (one operator): ~2,285,545 sats (~0.0229 BTC)
- Window:                        ~09:22–14:00 UTC, 2026-11-08
- Reporter:                      BitTipBot (@KevinR4v)
- Project-wide total:            not disclosed; no central aggregator

Action checklist

1. Stop your LNbits service now if it is still running — systemctl stop lnbits, docker compose down, or whatever your deploy uses. Do not restart on the current code.
2. Watch lnbits/lnbits releases and the pinned advisory for the patch. Ben Arc's 24–48h window dates from the advisory's publication, not from the time you read this.
3. Reconcile your backend node's payments against your LNbits internal ledger for the window above (and earlier, if your instance was exposed to the internet for longer). An anomalous outbound payment for which no corresponding user action exists is the signature pattern.
4. Do not relax the shutdown advisory on the basis of "my users are known" — the attack path the operators describe is account creation on live instances. Public signup is the exposed surface.
5. Rotate any admin keys and funding-source credentials before you bring the patched server back up, on the assumption those were exposed to a hostile authenticated session.

Context

LNbits sits in a specific crease of Lightning tooling: it is the default server a small operator runs when they need accounts on top of a single Lightning node. That makes it both popular — hundreds of self-hosted instances power community wallets, faucets and tipping bots — and fragile, because every incident requires every operator to act individually. Crypto Briefing notes that LNbits already patched a batch of issues in version 1.6.0 in September 2026 after an audit by V12; the current wave shows the attack surface this class of server offers is not exhausted.

The Lightning-account server category has taken repeated knocks this year — LNbits is the most used, but the structural problem is shared by any custodial Lightning service exposing a signup flow to the public internet. The lesson a careful operator has by now drawn: treat the account layer as the attack surface a determined adversary will always try first, not the node.

Sources:

• Crypto Briefing — LNbits urges users to shut down servers amid wave of attacks (Nov 8, 2026).
• The Defiant — LNbits Urges All Server Operators to Shut Down After Attacks (Nov 8, 2026).
• GitHub — lnbits/lnbits security advisories page (no advisory published for this incident at time of writing).