LNbits Self-Hosted Lightning Wallet Thefts

On November 10, 2026, LNbits — a widely used self-hosted Bitcoin Lightning wallet platform — shipped an emergency release (version 1.7.0) after a wave of attacks drained funds from independently operated installations, urging operators worldwide to shut their servers down while the total amount stolen remained undisclosed.

What happened

LNbits is open-source software that lets anyone run their own Lightning wallet, merchant checkout, tipping and paywall services; its creator estimated in May 2026 that roughly 200,000 people run it themselves. On Sunday, November 8, the project warned operators to disable its Paywall extension while it investigated a suspected flaw, and about an hour later told users to shut down their LNbits servers immediately, citing an active wave of attacks against self-hosted instances. LNbits said the vulnerability affected all versions before 1.7.0 and put wallet funds at risk of theft, and it took its own hosted installations offline. The project did not immediately publish the technical root cause, promising a separate exploit report to follow. No aggregate loss figure was disclosed; one operator, Kevin Ravensberg, reported that attackers used newly created accounts to withdraw about 2.3 million satoshis (~0.023 BTC) from his instance before he could react.

Aftermath

Patching alone was not enough: LNbits warned that updating would not protect installations whose credentials had already been compromised, and advised operators to reset wallet keys, replace funding-source credentials, treat all settings secrets as compromised, and migrate to a fresh server if a breach was suspected. The full scope — how many of the roughly 200,000 self-hosted instances were hit and how much Bitcoin was taken — had not been quantified at the time of writing, and no attacker addresses or transaction hashes were published.

Why it matters

The incident echoes the catalogue's run of self-hosted infrastructure compromises, where the weak point is operator-run software rather than an on-chain contract — most directly the BTCPay Server hot-wallet thefts weeks earlier. With hundreds of thousands of independent deployments, a single server-side flaw becomes a fleet-wide emergency, and because many operators custody real user balances, the blast radius is impossible to measure centrally. It is a reminder that Lightning's self-custody ethos shifts the security burden onto operators who must patch, rotate secrets and monitor on their own.