LNbits urged all server operators to shut down their instances on Nov. 8 after reported attacks. It had earlier told operators to disable its Paywall extension while it investigated a potential vulnerability, and it suspended its hosted service, my.lnbits.com. Developers expected patches within 24 to 48 hours; the hosted service could resume once fixes were in place.
Bittipbot operator Kevin Ravensberg said attackers created unauthorized accounts on his LNbits instance and withdrew 2,285,545 satoshis. He pledged to reimburse affected users, but said access to funds would remain restricted until the vulnerabilities were addressed. Investigators had not publicly established the precise exploit behind the withdrawals.
