-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0330
============================================================

Advisory-ID:  0xCERT-2026-0330
Severity:     High
Published:    2026-11-08T13:56:18.000Z
Updated:      2026-11-09T16:43:34.011Z
Chains:       Bitcoin
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0330

Title: LNbits urges all operators to stop servers immediately after attacks drain funds from Lightning instances

Summary
- -------
After a wave of attacks in which accounts were created on LNbits instances and funds withdrawn without authorization, the LNbits team told all users to stop their LNbits servers immediately until security patches are released. Keep servers offline until a patched release is published.

Details
- -------
Summary
On 8 November 2026 the LNbits team told all LNbits users to stop their LNbits servers immediately, following a wave of attacks, and said a number of security patches were being prepared. SlowMist records that attackers created accounts on LNbits instances and withdrew funds without authorization; one instance reported a loss of about 2,285,545 sats.

Affected
- - Self-hosted LNbits servers (Bitcoin Lightning wallet/accounts system); affected versions not yet stated by LNbits
- - No fix available at time of publication; patches announced as forthcoming

Impact
Attackers can create accounts on an exposed LNbits instance and withdraw Lightning funds without authorization (per SlowMist). Exploitation in the wild is confirmed. LNbits has not published technical details, affected versions or CVE identifiers at the time of publication.

Recommended actions
- - Stop LNbits servers now, as instructed by the LNbits team, and keep them offline until a patched release is published.
- - If you must keep funds reachable, move Lightning liquidity out of the LNbits-connected node wallet to a wallet not exposed through LNbits.
- - After patching, review account lists and payment history for unknown accounts and unexpected outgoing payments, and rotate admin and API keys.
- - Follow updates only from LNbits' official channels.

Source & attribution
This 0xCERT advisory summarises a disclosure by the LNbits team (https://x.com/lnbits/status/2119428804951048237) and SlowMist's incident record (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/lnbits/status/2119428804951048237
- - https://hacked.slowmist.io/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrzxuAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfW6EiitPefNINi0Y5M1qNqSbkYzg6Vs1H8IY/U
EffCIBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAARogEAgcMLsfQqRVdEyDNp
FO2CUDgC+45RbFJ6Jr7vAAta6mcBAOYmfE2jCr9V7RLlHxrJ3w+fymtMInts
8swt57tOMEEL
=N5pv
-----END PGP SIGNATURE-----