On Nov 8, 2026, LNbits – an open‑source wallet and payments platform for the Lightning Network – issued an urgent advisory instructing all server operators to shut down their instances immediately. The warning, posted on the project’s X account at 13:56 UTC, cited a wave of attacks that had already resulted in the loss of 2,285,545 satoshis (about 0.0229 BTC) from a Bittipbot service. Core contributor Ben Arc emphasized that security patches were being prepared and would be released within the next 24 to 48 hours, urging the community to circulate the alert widely.

Scope of the Exploit and Immediate Impact

The incident was first reported by Dutch operator Kevin Ravensberg, whose LNbits‑powered Bittipbot on Telegram saw attackers create new accounts and withdraw the funds between 09:22 a.m. and 14:00 UTC on the same day. Ravensberg pledged to reimburse affected users personally, though access to the stolen funds remains blocked pending a fix. LNbits also advised operators of its Paywall extension to disable the feature at 12:33 UTC, indicating that the vulnerability was not limited to a single module. The project’s hosted service, my.lnbits.com, has been suspended, with developers indicating that operations could resume once the pending patches are applied and verified.

Broader Lightning Network Security Context

The LNbits shutdown follows a turbulent period for Lightning Network infrastructure. Throughout 2026, developers of major implementations such as Core Lightning, the Lightning Development Kit (LDK), and Eclair have been addressing a series of vulnerabilities, including AI‑assisted reports, denial‑of‑service flaws, and channel‑management weaknesses. In August, roughly 22% of Core Lightning nodes went offline after critical patches were recommended. Recent months have also seen capacity declines on the network, with newhedge.io reporting a loss of over 1,100 BTC since July, bringing total capacity back to mid‑2022 levels. These trends underscore the ongoing challenge of securing not only the underlying protocol but also the myriad applications built atop it.

What to Watch Next

Stakeholders should monitor LNbits’ official channels for the release of the promised security patches and the timeline for reinstating the hosted service. Additional scrutiny is likely to focus on the specific exploit used to create unauthorized accounts, which remains undisclosed. Operators of other Lightning‑based applications may also issue precautionary advisories, especially if they rely on similar modular extensions. Finally, the broader Lightning community will be watching network capacity metrics for signs of recovery or further decline as patches are deployed across the ecosystem.