The open-source Bitcoin Lightning Network wallet tool, LNbits, has issued an urgent advisory for all server operators to shut down their instances. This decision follows reports of unauthorized account creation and fund withdrawals by attackers.
The security incident gained public attention after the operator of BitTipBot reported a loss of approximately 2,285,545 sats, equivalent to 0.0229 BTC. The exploit occurred within a five-hour window on November 8, 2026, between 9:22 UTC and 14:00 UTC.
LNbits is currently developing multiple security patches to address the vulnerabilities. The project expects to release these updates within 24 to 48 hours of the initial warning. Operators are advised to keep their servers offline until the patches are applied.
As a decentralized tool, LNbits lacks a central control mechanism to secure individual instances. Consequently, the project has requested that the community disseminate the warning to ensure all self-hosted operators take action independently.
This incident follows previous security updates released in September 2026 for version 1.6.0, which were implemented after an audit by V12. While other projects like Electrum and Core Lightning also issued updates in November 2026, no direct link to the LNbits exploit has been confirmed.
