--- id: "CMP-202611-oa3nhs" page: "https://infrastack.ai/live/CMP-202611-oa3nhs" kind: "campaign" aliases: [] title: "Attackers drain funds from self-hosted LNbits Bitcoin Lightning wallet servers through an LNbits extension flaw; LNbits tells all operators to shut down (no patch yet)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "LNbits", "fixed": [], "vendor": "LNbits", "ecosystem": "self-hosted"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-09T10:27:59+00:00" updated_at: "2026-11-09T10:29:23+00:00" sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html", "first_seen_at": "2026-11-09T10:27:59+00:00", "cites": ["https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html"]}] exploit_sources: [] --- # Attackers drain funds from self-hosted LNbits Bitcoin Lightning wallet servers through an LNbits extension flaw; LNbits tells all operators to shut down (no patch yet) Link for people: https://infrastack.ai/live/CMP-202611-oa3nhs (this .md is for agents) Since at least 8 Nov 2026 09:22 UTC, attackers have been exploiting an LNbits extension on self-hosted LNbits servers. Newly created accounts withdraw funds. One operator (BitTipBot, a Telegram bot) lost 2,285,545 sats (about 0.023 BTC) between 09:22 and 14:00 UTC on 8 Nov, more than three hours before LNbits' first warning. At 12:33 UTC on 8 Nov LNbits asked operators to disable the Paywall extension over a possible bug. About 80 minutes later it told ALL operators to shut down their LNbits servers until several security fixes ship. LNbits also switched off its own hosted service my.lnbits.com and expects it back within 24h. The exploited extension has not been named publicly, and it is unknown whether it is Paywall. As of 09:00 UTC on 9 Nov there is no fixed version. A developer estimates patches within 24-48h of 8 Nov, so roughly 14:00 UTC 9 Nov to 14:00 UTC 10 Nov. The number of servers hit and total losses are unknown. The notice covers LNbits servers, not Lightning nodes or other wallet software. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - self-hosted:LNbits affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a known vulnerability left unpatched (unpatched-vuln). Attackers have been exploiting an LNbits extension flaw on self-hosted LNbits servers, where newly created accounts withdraw funds, and the operators who rely on that platform (including the hosted my.lnbits.com) face drained wallets. How it reached others: customers' data or keys went with it (third-party-breach). So it does not happen to you: Your board lists the advisories that are in range for your stack, with the fix version. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach ## How to check You are affected if you run a self-hosted LNbits server, or hold funds on my.lnbits.com. On LNbits servers, look for accounts/wallets created on or after 8 Nov 2026 that withdrew funds, especially between 09:22 and 14:00 UTC on 8 Nov, and for unexpected outgoing payments from the server's Lightning funding source. Check whether the Paywall extension (or any other extension) is enabled. LNbits has not published indicators or a way to check whether a server was hit. ## Fix Shut down your LNbits server now, as the project asks, and keep it off until LNbits releases the security fixes; then upgrade before restarting. If you cannot shut down, at least disable the Paywall extension and other unneeded extensions and block new account sign-ups. Even if you shut down after the notice, review new accounts and withdrawals since 8 Nov 09:22 UTC. Your Lightning node itself is not named in the notice. ## Timeline - 2026-11-09T10:27:59+00:00 analyst https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html ## Documents - [describes] @TheHackersNews: ‼️WARNING - Bitcoin Lightning wallet platform LNbits urges ALL server operators https://x.com/TheHackersNews/status/2119732285817618928 - [describes] LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_