"Patches 'should be merged and available within 24-48hrs,'" Ben Arc, an LNbits developer, wrote in a patch estimate yesterday — a tight timetable issued as the project told every operator to shut down their LNbits servers immediately amid an active wave of attacks.
LNbits' shutdown notice and operator guidance
The LNbits project posted a blunt, system-wide instruction yesterday: everyone running LNbits should shut down their servers now because of ongoing attacks. The notice followed an earlier, narrower warning that asked operators to disable the Paywall add-on while the project investigated a possible bug. About 80 minutes after that first warning, the project expanded the instruction into a full shutdown appeal.
As of 09:00 UTC today, the project had not released a fixed version, had not cancelled the shutdown notice, had not offered an alternative option for operators, and had not published a way for operators to check whether their servers were hit before they were taken offline.
The attack timeline and a reported loss by Kevin Ravensberg
One operator, Kevin Ravensberg, reported that his server was exploited and that the attack on his instance ran from 09:22 to 14:00 UTC yesterday. Ravensberg said the exploit withdrew 2,285,545 satoshis — about 0.023 bitcoin — from his server before he could stop it. He reported the loss on X and said the exploit began more than three hours before the project's first public warning at 12:33 UTC.
Ravensberg has said he will repay users of BitTipBot, a Telegram bot tied to his service, but those users cannot reach their funds until LNbits releases fixes for the flaws that allowed the withdrawals. Later yesterday, Ravensberg posted that Ben Arc and a team of security testers had confirmed "which exact extension exploit was used" on his server, though neither Ravensberg nor the project had named that extension on X as of 09:00 UTC today.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePaywall add-on named in the first warning; exploit origin remains unclear
The project's initial advisory singled out Paywall, an add-on that requires payment to view content, and asked operators to disable it while investigators looked into a potential bug. By 09:00 UTC today the project had not stated whether Paywall was the add-on exploited in the attacks. Ravensberg and the project confirmed an extension-level exploit was used on his server but did not identify which extension in public posts by that time.
Patch timetable, hosted instances, and service suspension
Ben Arc estimated in a post that patches "should be merged and available within 24-48hrs." Counted from his post, the project said that timeframe corresponds to roughly between about 14:00 UTC today and 14:00 UTC tomorrow. Separately, the project switched off all the LNbits instances it runs for users on its cloud service, my.lnbits.com, later yesterday and posted that its hosted services would be back within 24 hours — or by about 17:20 UTC today.
Until those fixes are merged and published, LNbits' public guidance remains a full shutdown of operator servers. The notice specifically covered LNbits servers and did not mention Lightning nodes or other wallet software. The project did not state how many servers were hit or the total amount taken across affected instances.
How LNbits operators, technologists, and BitTipBot users are responding
- LNbits operators: The project's language directed them to shut down servers immediately; some complied and platform-run instances were taken offline by the project itself. Operators who delayed or missed the shutdown risk losing funds on their hosted instances, as Ravensberg reported.
- Technologists and security teams: Security testers linked to the project confirmed they had identified the specific extension exploit used on a compromised server, and the project has prioritized preparing patches — with Ben Arc's 24–48 hour estimate forming the public timetable.
- BitTipBot users and hosted-service customers: Users tied to affected third-party bots and the project's hosted instances are unable to access funds until the flaws are fixed; one operator has promised to repay affected users but said funds are currently inaccessible pending the project's fixes.
The immediate facts are straightforward: LNbits issued a broad shutdown order, at least one operator reported a quantified loss, an extension-level exploit was confirmed on that instance, and the project set a 24–48 hour patch window while taking its own hosted instances offline. What remains pending in public posts as of 09:00 UTC today is the publication of a fixed release, a clear attribution of which extension was exploited across incidents, and any tools for operators to audit whether their servers were compromised before they shut them down.
