Skip to navigation

Threat reportVulnerabilityTL-2026-5599

LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit

highACTIVE

On 2026-11-08 the LNbits project told all operators to stop their LNbits servers immediately after attackers created new accounts and withdrew funds, including 2,285,545 sats (about 0.0229 BTC) from the BitTipBot instance. The exploited extension has not been publicly named, no CVE exists, and no fixed release had been published as of 2026-11-09.

Key facts

IdentifiersTL-2026-5599
SeverityHIGH
First disclosed
Affected productsLNbits LNbits (self-hosted servers and my.lnbits.com hosted service) with extensions installed
MalwarePython
MITRE ATT&CK techniquesT1078 Valid Accounts, T1136 Create Account, T1190 Exploit Public-Facing Application, T1657 Financial Theft
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency, fintech
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5599 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LNbits Extension (Paywall) Requests From Client Creating Accounts — Exploitation Phase

Behaviour-first hunt for the 2026-11-08 LNbits extension exploit (TL-2026-5599): a single client hitting Paywall extension endpoints while also creating LNbits accounts and then operating as a new valid account. The exploited extension is unnamed, so Paywall is a hypothesis; extend the path list as LNbits names the vector.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1136, T1078
  • Data sources: nginx access log (index=web, sourcetype=access_combined), Syslog table (nginx access log), webserver logsource (reverse proxy in front of LNbits)
  • Severity: high
  • Confidence: medium

Splunk SPL

index=web sourcetype=access_combined earliest=-24h method=POST (uri_path="/paywall/api/*" OR uri_path="/api/v1/account" OR uri_path="/usermanager/api/v1/users*")
| eval ext_hit=if(like(uri_path,"/paywall/api/%"),1,0)
| eval acct_create=if(uri_path="/api/v1/account" OR like(uri_path,"/usermanager/api/v1/users%"),1,0)
```comment: TL-2026-5599 hunt for LNbits Paywall extension requests plus account creation from one client```
| stats sum(ext_hit) as ext_requests sum(acct_create) as acct_creates dc(uri_path) as distinct_paths min(_time) as first_seen max(_time) as last_seen by clientip host
| where ext_requests>=1 AND acct_creates>=3
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host clientip ext_requests acct_creates distinct_paths first_seen last_seen

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "nginx"
| parse SyslogMessage with ClientIP " - " * " [" * '] "' Method " " Uri " HTTP/" * '" ' Status:int " " *
| where Method == "POST" and Status in (200, 201)
| where Uri startswith "/paywall/api/" or Uri =~ "/api/v1/account" or Uri startswith "/usermanager/api/v1/users"
| extend IsExt = Uri startswith "/paywall/api/"
| summarize ExtRequests = countif(IsExt), AcctCreates = countif(not(IsExt)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP, Computer
| where ExtRequests >= 1 and AcctCreates >= 3
| project FirstSeen, LastSeen, Computer, ClientIP, ExtRequests, AcctCreates

Sigma

title: LNbits Paywall Extension API POST Request - Hunting
id: 5b0f3c1e-8a47-4d52-9c61-7e2a1b9d4f01
status: experimental
description: Detects successful POST requests to the LNbits Paywall extension API. LNbits flagged Paywall first during the 2026-11-08 extension-exploit wave (TL-2026-5599) and the exploited extension is unconfirmed, so this is a hunting rule. Pivot on the client IP to account creation.
references:
    - https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html
    - https://www.tftc.io/lnbits-emergency-shutdown-active-attack-funds-drained
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1136
    - attack.t1078
logsource:
    category: webserver
detection:
    selection_ext:
        cs-method: 'POST'
        c-uri|contains: '/paywall/api/'
    selection_status:
        sc-status:
            - 200
            - 201
    condition: selection_ext and selection_status
falsepositives:
    - Legitimate visitors purchasing access through a Paywall extension instance
    - Operator testing of the Paywall extension
level: medium

Known false positives:

  • Legitimate visitors paying for Paywall-protected content who also register an account
  • Operator testing of the Paywall extension and sign-up flow

Tuning notes: Adjust the acct_creates threshold to your sign-up volume, add other extension prefixes once LNbits names the exploited extension, change index/sourcetype to match your reverse-proxy log, and allowlist monitoring IPs. Access logs do not show POST bodies, so pair with LNbits application logs where available.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • [indicator] Extension API Probing Across Many Extensions (Sentinel) — Exploitation Phase · unlock with TL Creds
  • [indicator] Payments API Used By Client After Account Creation (Sentinel) — Withdrawal Phase · unlock with TL Creds
  • [indicator] Secrets Or Database Read By Copy/Archive/Upload Tool (Sentinel) — Credential Access Hypothesis · unlock with TL Creds
  • [indicator] Extension Install, Enable Or Removal Via API (Sigma) — Exploitation Phase · unlock with TL Creds
  • Shell Or Download Tool Spawned By [indicator] Python Process (Sigma) — Post-Exploitation Phase · unlock with TL Creds
  • [indicator] Admin Settings, Wallet Top-Up Or User Changes From Unexpected Client (Sigma) — Account Manipulation · unlock with TL Creds
  • [indicator] Burst Of New Account Creation — Post-Exploitation Phase · unlock with TL Creds
  • [indicator] Process Makes Non-Web Outbound Connection To Public IP — C2 / Exfil Hypothesis · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5599.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

LNbits is an open-source, Python-based accounting layer and wallet system that sits on top of Lightning Network funding sources (such as LND and Core Lightning) and is extended through an add-on/extension system (tip bots, point-of-sale, paywalls, shared wallets). On 2026-11-08 the project reported a wave of attacks against LNbits servers.

Per the operator of the BitTipBot Telegram bot (Kevin Ravensberg), attackers began creating new accounts on his LNbits instance at about 09:22 UTC and withdrew 2,285,545 sats before the activity ended at about 14:00 UTC, a window of roughly five hours; the withdrawals occurred before he could stop the server. He stated that LNbits developer Ben Arc and security testers confirmed which extension exploit was used against his server, but the extension was not named publicly. At 12:33 UTC LNbits first warned operators about a possible bug and asked them to disable the Paywall extension; at about 13:56 UTC (roughly 80 minutes later) it escalated to a notice that all LNbits users should stop their servers IMMEDIATELY. LNbits later disabled all instances on its managed service my.lnbits.com as a precaution, with restoration promised within about 24 hours of a confirmed fix.

Technical detail is limited. The reported behaviour is unauthorized account creation followed by unauthorized withdrawals from those new accounts, tied to an extension-level flaw. The project has not stated whether Paywall is the sole vector, whether the flaw sits in core account management or an extension, which versions are affected, or how many servers were hit. The notice is scoped to LNbits servers; reporting indicates the underlying Lightning nodes (LND, Core Lightning) were not directly targeted. No CVE, CVSS score, CWE, IOCs or attacker attribution have been published.

Ben Arc estimated that patches would be merged and available within 24-48 hours of the notice (earliest about 2026-11-09 14:00 UTC, latest about 2026-11-10 14:00 UTC). As of 2026-11-09 14:46 UTC the latest GitHub release was still v1.6.2 (2026-09-18), which does not address this incident, and the shutdown guidance did not give operators a way to check for compromise. Context: LNbits shipped v1.6.0 security fixes in September 2026 following a V12 audit, and earlier GitHub advisories exist for 2024 (Eclair backend, GHSA-3j4h-h3fp-vwww) and 2025 (LNURL-auth SSRF, GHSA-qp8j-p87f-c8cc); none are linked to this incident. BTCPay Server separately asked operators to go offline earlier in November over wallet thefts; no link to this incident has been stated.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts; T1136 Create Account

Impact

T1657 Financial Theft

Remediation

Patches

  • No fixed version published as of 2026-11-09; LNbits developer Ben Arc estimated patches within 24-48 hours of the 2026-11-08 notice. Latest release at time of writing is v1.6.2 (2026-09-18), which is not described as a fix for this incident

Immediate actions

  • Stop all LNbits servers immediately, as instructed by the LNbits project on 2026-11-08; there is no central kill switch, so each operator must act on its own instance
  • Disable the Paywall extension (first LNbits warning, 12:33 UTC 2026-11-08) if the server cannot be stopped
  • Review user/account lists for accounts created since 2026-11-08 ~09:00 UTC and review withdrawal/payment history for unexpected outbound payments
  • Do not restart instances until LNbits announces confirmed patches via the official @lnbits channel

Workarounds

  • Take LNbits instances offline
  • Disable the Paywall extension until the affected extension is confirmed

Longer-term hardening

  • Restrict installed extensions to those actually required and review extension permissions and wallet funding limits
  • Limit funds held on LNbits-backed funding sources to operational amounts and monitor outbound payments against the backing node
  • Alert on bulk or rapid new-account creation and on withdrawals from newly created accounts

Affected and fixed versions

  • LNbits — LNbits (self-hosted servers and my.lnbits.com hosted service) with extensions installed
    Vulnerable versions: Undisclosed; the notice covers all LNbits servers (latest release v1.6.2 as of 2026-11-09)

Timeline

  • Unrelated earlier LNbits advisory GHSA-qp8j-p87f-c8cc (LNURL-auth SSRF, High) published; shown for context, not linked to this incident
  • LNbits v1.6.2 released (PostgreSQL backups); it remained the latest release on 2026-11-09. v1.6.0 security fixes following a V12 audit shipped in September 2026
  • LNbits disables all instances on its managed service locked-ioc-1 as a precaution, promising restoration within about 24 hours; developer Ben Arc estimates patches within 24-48 hours
  • ~14:00 UTC: end of the roughly five-hour drain window; 2,285,545 sats (about 0.0229 BTC) withdrawn from BitTipBot before the server was stopped
  • ~13:56 UTC: LNbits tells all operators to stop their LNbits servers immediately, about 80 minutes after the first warning
  • 12:33 UTC: LNbits warns of a possible bug and asks operators to disable the Paywall extension
  • 09:22 UTC: attackers begin creating new accounts and withdrawing funds on the BitTipBot LNbits instance, per operator Kevin Ravensberg
  • As of 09:00 UTC (and 14:46 UTC per Coin Insider) no fixed release, compromise-check guidance, or named exploited extension had been published; v1.6.2 still the latest release
  • Latest estimated patch availability (~14:00 UTC) based on the 24-48 hour estimate; unconfirmed forecast, not an observed event

Sources cited

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats