The LNbits project told all operators of its open-source Bitcoin Lightning wallet system to shut their servers down on Monday, November 9, after attackers exploited a flaw in a paywall extension to withdraw funds without authorization. The project also took its hosted service, my.lnbits.com, offline.
Paywall Extension Flaw Lets Attackers Withdraw Funds
Attackers abused a vulnerability in an LNbits paywall extension to pull money out of wallets without authorization. No CVE identifier has been cited for the flaw. The shutdown advisory applies to every operator, not only those running the extension, and reflects the project’s decision to take instances offline until a fix is ready.
BitTipBot Loses 2,285,545 Sats Over Nearly Five Hours
One operator, BitTipBot, lost 2,285,545 satoshis, roughly 0.023 BTC, between 09:22 and 14:00 UTC on November 9. A public warning went out at 12:33 UTC, partway through that theft window. Operator Kevin Ravensberg pledged to reimburse the users who were affected.
The losses reported so far are small by cryptocurrency-theft standards. The advisory, however, covers all self-hosted instances, which suggests the project could not rule out exposure elsewhere.
LNbits Developer Expects Fix Within 24 to 48 Hours
LNbits developer Ben Arc said he expected fixes within 24 to 48 hours. As of the next morning, no patched version had been released. The project has promised that the hosted my.lnbits.com service will return within 24 hours.
Until a patch arrives, the shutdown advisory is the only mitigation the project has issued. Operators who keep their servers running accept the risk that the same extension flaw could be used against them.
Why Self-Hosted Lightning Operators Face the Largest Exposure
LNbits is open-source software that operators run themselves, often to offer wallets to other users. That model means a single extension vulnerability can affect many independent operators, each holding user balances. BitTipBot’s reimbursement pledge illustrates the responsibility that rests with operators: when funds leave an instance, the operator is the party users look to for repayment.
Unresolved Questions About the Extension Flaw
The reporting leaves gaps. It does not name the extension beyond calling it a paywall extension, does not say whether other operators lost funds, and does not explain how the attack worked technically. The developer’s timeline for fixes is an estimate, and the project had not met it at the time of the latest report.
For operators, the project’s position is unambiguous: stop the server and wait. The theft on BitTipBot’s server ran for several hours, and the warning landed only after it was well under way, which may account for the breadth of the shutdown request.
LNbits has not said how it will notify operators when a patched release is available, or whether it will recommend any checks of wallet activity before bringing servers back online.
Timeline of the BitTipBot Theft and the Warning
The theft on BitTipBot’s server ran from 09:22 to 14:00 UTC, a span of about four hours and 38 minutes. The public warning went out at 12:33 UTC, more than three hours after the first withdrawal, and the attack window stayed open for another hour and a half after that. The loss of 2,285,545 sats came entirely from this one operator in the account given, and Ravensberg’s reimbursement pledge covers the users on that server. LNbits has not named any other affected operator, and the project’s shutdown request therefore rests on the nature of the flaw rather than on a list of confirmed victims.
Operators who run LNbits typically hold funds on behalf of their own users, and the shutdown request therefore affects end users as well as administrators. The hosted my.lnbits.com service is offline, with the project promising its return within 24 hours, while self-hosted operators have no stated return date because they depend on a patched release that had not shipped by the following morning.
