LNbits urges all operators to stop servers immediately after attacks drain funds from Lightning instances

Summary

On 8 November 2026 the LNbits team told all LNbits users to stop their LNbits servers immediately, following a wave of attacks, and said a number of security patches were being prepared. SlowMist records that attackers created accounts on LNbits instances and withdrew funds without authorization; one instance reported a loss of about 2,285,545 sats.

Affected

• Self-hosted LNbits servers (Bitcoin Lightning wallet/accounts system); affected versions not yet stated by LNbits
• No fix available at time of publication; patches announced as forthcoming

Impact

Attackers can create accounts on an exposed LNbits instance and withdraw Lightning funds without authorization (per SlowMist). Exploitation in the wild is confirmed. LNbits has not published technical details, affected versions or CVE identifiers at the time of publication.

Recommended actions

• Stop LNbits servers now, as instructed by the LNbits team, and keep them offline until a patched release is published.
• If you must keep funds reachable, move Lightning liquidity out of the LNbits-connected node wallet to a wallet not exposed through LNbits.
• After patching, review account lists and payment history for unknown accounts and unexpected outgoing payments, and rotate admin and API keys.
• Follow updates only from LNbits' official channels.

Source & attribution

This 0xCERT advisory summarises a disclosure by the LNbits team (https://x.com/lnbits/status/2119428804951048237) and SlowMist's incident record (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record.