LNbits Operators Lose 2.28M Satoshis to Paywall Exploit Before Shutdown
LNbits ordered all operators to shut down servers after confirmed exploitation of the Paywall extension drained funds from at least one instance. Evidence from operator reports and developer timelines shows delayed detection and limited scope disclosure. The event highlights persistent risks in unmonitored self-hosted crypto wallet extensions.
The project issued a shutdown notice after multiple attacks targeted LNbits Lightning wallet servers. Initial guidance disabled only the Paywall add-on at 12:33 UTC, but the full notice followed 80 minutes later. my.lnbits.com cloud instances were also taken offline with a 24-hour restoration target. No fixed release exists as of 09:00 UTC today.
Operator Kevin Ravensberg documented the drain on X and stated security testers later confirmed the exact extension vector used. Ben Arc estimated patches would merge in 24-48 hours. The project has released neither the total number of affected servers nor aggregate losses beyond this single reported incident.
This matches repeated patterns in open-source Lightning tooling where public extensions become immediate exploit surfaces once disclosed. The three-hour gap between first observed theft and project warning indicates insufficient telemetry on self-hosted instances.
Operators must audit logs for unauthorized withdrawals before restart. Patches are expected between 14:00 UTC today and tomorrow; independent verification of the fixed extension code will be required.
Sources (2)
- [1]The Hacker News Report(https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html)
- [2]Operator Loss Report on X(https://x.com/kevinravensberg)