LNBITS · CMP-202611-oa3nhs · Vendor
NO FIX YET · SEE WHAT TO DO
Since at least 8 Nov 2026 09:22 UTC, attackers have been exploiting an LNbits extension on self-hosted LNbits servers. Newly created accounts withdraw funds. One operator (BitTipBot, a Telegram bot) lost 2,285,545 sats (about 0.023 BTC) between 09:22 and 14:00 UTC on 8 Nov, more than three hours before LNbits' first warning. At 12:33 UTC on 8 Nov LNbits asked operators to disable the Paywall extension over a possible bug. About 80 minutes later it told ALL operators to shut down their LNbits servers until several security fixes ship. LNbits also switched off its own hosted service my.lnbits.com and expects it back within 24h. The exploited extension has not been named publicly, and it is unknown whether it is Paywall. As of 09:00 UTC on 9 Nov there is no fixed version. A developer estimates patches within 24-48h of 8 Nov, so roughly 14:00 UTC 9 Nov to 14:00 UTC 10 Nov. The number of servers hit and total losses are unknown. The notice covers LNbits servers, not Lightning nodes or other wallet software.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.