# LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit

> On 2026-11-08 the LNbits project told all operators to stop their LNbits servers immediately after attackers created new accounts and withdrew funds, including 2,285,545 sats (about 0.0229 BTC) from the BitTipBot instance. The exploited extension has not been publicly named, no CVE exists, and no fixed release had been published as of 2026-11-09.

- **Published:** 2026-11-09T23:09:02Z
- **Last reviewed:** 2026-11-09T23:09:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5599
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5599.png
- **ID:** TL-2026-5599
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

LNbits is an open-source, Python-based accounting layer and wallet system that sits on top of Lightning Network funding sources (such as LND and Core Lightning) and is extended through an add-on/extension system (tip bots, point-of-sale, paywalls, shared wallets). On 2026-11-08 the project reported a wave of attacks against LNbits servers.

Per the operator of the BitTipBot Telegram bot (Kevin Ravensberg), attackers began creating new accounts on his LNbits instance at about 09:22 UTC and withdrew 2,285,545 sats before the activity ended at about 14:00 UTC, a window of roughly five hours; the withdrawals occurred before he could stop the server. He stated that LNbits developer Ben Arc and security testers confirmed which extension exploit was used against his server, but the extension was not named publicly. At 12:33 UTC LNbits first warned operators about a possible bug and asked them to disable the Paywall extension; at about 13:56 UTC (roughly 80 minutes later) it escalated to a notice that all LNbits users should stop their servers IMMEDIATELY. LNbits later disabled all instances on its managed service my.lnbits.com as a precaution, with restoration promised within about 24 hours of a confirmed fix.

Technical detail is limited. The reported behaviour is unauthorized account creation followed by unauthorized withdrawals from those new accounts, tied to an extension-level flaw. The project has not stated whether Paywall is the sole vector, whether the flaw sits in core account management or an extension, which versions are affected, or how many servers were hit. The notice is scoped to LNbits servers; reporting indicates the underlying Lightning nodes (LND, Core Lightning) were not directly targeted. No CVE, CVSS score, CWE, IOCs or attacker attribution have been published.

Ben Arc estimated that patches would be merged and available within 24-48 hours of the notice (earliest about 2026-11-09 14:00 UTC, latest about 2026-11-10 14:00 UTC). As of 2026-11-09 14:46 UTC the latest GitHub release was still v1.6.2 (2026-09-18), which does not address this incident, and the shutdown guidance did not give operators a way to check for compromise. Context: LNbits shipped v1.6.0 security fixes in September 2026 following a V12 audit, and earlier GitHub advisories exist for 2024 (Eclair backend, GHSA-3j4h-h3fp-vwww) and 2025 (LNURL-auth SSRF, GHSA-qp8j-p87f-c8cc); none are linked to this incident. BTCPay Server separately asked operators to go offline earlier in November over wallet thefts; no link to this incident has been stated.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1136 Create Account
- T1078 Valid Accounts
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LNbits Extension (Paywall) Requests From Client Creating Accounts — Exploitation Phase** (`TL-2026-5599-SPL-001`)

Behaviour-first hunt for the 2026-11-08 LNbits extension exploit (TL-2026-5599): a single client hitting Paywall extension endpoints while also creating LNbits accounts and then operating as a new valid account. The exploited extension is unnamed, so Paywall is a hypothesis; extend the path list as LNbits names the vector.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1136, T1078
- **Data sources:** nginx access log (index=web, sourcetype=access_combined), Syslog table (nginx access log), webserver logsource (reverse proxy in front of LNbits)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=web sourcetype=access_combined earliest=-24h method=POST (uri_path="/paywall/api/*" OR uri_path="/api/v1/account" OR uri_path="/usermanager/api/v1/users*")
| eval ext_hit=if(like(uri_path,"/paywall/api/%"),1,0)
| eval acct_create=if(uri_path="/api/v1/account" OR like(uri_path,"/usermanager/api/v1/users%"),1,0)
```comment: TL-2026-5599 hunt for LNbits Paywall extension requests plus account creation from one client```
| stats sum(ext_hit) as ext_requests sum(acct_create) as acct_creates dc(uri_path) as distinct_paths min(_time) as first_seen max(_time) as last_seen by clientip host
| where ext_requests>=1 AND acct_creates>=3
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host clientip ext_requests acct_creates distinct_paths first_seen last_seen
````

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "nginx"
| parse SyslogMessage with ClientIP " - " * " [" * '] "' Method " " Uri " HTTP/" * '" ' Status:int " " *
| where Method == "POST" and Status in (200, 201)
| where Uri startswith "/paywall/api/" or Uri =~ "/api/v1/account" or Uri startswith "/usermanager/api/v1/users"
| extend IsExt = Uri startswith "/paywall/api/"
| summarize ExtRequests = countif(IsExt), AcctCreates = countif(not(IsExt)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP, Computer
| where ExtRequests >= 1 and AcctCreates >= 3
| project FirstSeen, LastSeen, Computer, ClientIP, ExtRequests, AcctCreates
```

### Sigma

```yaml
title: LNbits Paywall Extension API POST Request - Hunting
id: 5b0f3c1e-8a47-4d52-9c61-7e2a1b9d4f01
status: experimental
description: Detects successful POST requests to the LNbits Paywall extension API. LNbits flagged Paywall first during the 2026-11-08 extension-exploit wave (TL-2026-5599) and the exploited extension is unconfirmed, so this is a hunting rule. Pivot on the client IP to account creation.
references:
    - https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html
    - https://www.tftc.io/lnbits-emergency-shutdown-active-attack-funds-drained
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1136
    - attack.t1078
logsource:
    category: webserver
detection:
    selection_ext:
        cs-method: 'POST'
        c-uri|contains: '/paywall/api/'
    selection_status:
        sc-status:
            - 200
            - 201
    condition: selection_ext and selection_status
falsepositives:
    - Legitimate visitors purchasing access through a Paywall extension instance
    - Operator testing of the Paywall extension
level: medium

```

**Known false positives:**

- Legitimate visitors paying for Paywall-protected content who also register an account
- Operator testing of the Paywall extension and sign-up flow

**Tuning notes:** Adjust the acct_creates threshold to your sign-up volume, add other extension prefixes once LNbits names the exploited extension, change index/sourcetype to match your reverse-proxy log, and allowlist monitoring IPs. Access logs do not show POST bodies, so pair with LNbits application logs where available.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] Extension API Probing Across Many Extensions (Sentinel) — Exploitation Phase (locked: unlock with TL Creds)
- [indicator] Payments API Used By Client After Account Creation (Sentinel) — Withdrawal Phase (locked: unlock with TL Creds)
- [indicator] Secrets Or Database Read By Copy/Archive/Upload Tool (Sentinel) — Credential Access Hypothesis (locked: unlock with TL Creds)
- [indicator] Extension Install, Enable Or Removal Via API (Sigma) — Exploitation Phase (locked: unlock with TL Creds)
- Shell Or Download Tool Spawned By [indicator] Python Process (Sigma) — Post-Exploitation Phase (locked: unlock with TL Creds)
- [indicator] Admin Settings, Wallet Top-Up Or User Changes From Unexpected Client (Sigma) — Account Manipulation (locked: unlock with TL Creds)
- [indicator] Burst Of New Account Creation — Post-Exploitation Phase (locked: unlock with TL Creds)
- [indicator] Process Makes Non-Web Outbound Connection To Public IP — C2 / Exfil Hypothesis (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks](https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html)
- [LNbits Orders Emergency Shutdown After Active Attacks Drain Sats](https://www.tftc.io/lnbits-emergency-shutdown-active-attack-funds-drained)
- [LNbits Awaits Security Fix After Server Shutdown Warning](https://www.coininsider.org/news/lnbits-operators-still-await-security-release-after-shutdown-warning/)
- [LNbits pide apagar sus servidores tras reportes de fondos drenados](https://www.diariobitcoin.com/criptomonedas/lnbits-pide-apagar-sus-servidores-tras-reportes-de-fondos-drenados/)
- [LNbits Urges Users to Shut Down Servers Amid Multiple Attack Incidents](https://www.kucoin.com/news/flash/lnbits-urges-users-to-shut-down-servers-amid-multiple-attack-incidents)
- [LNbits shutdown notice (@lnbits on X), as cited by The Hacker News](https://x.com/lnbits/status/2119428804951048237)
- [LNbits GitHub security advisories (no 2026 advisory for this incident listed)](https://github.com/lnbits/lnbits/security/advisories)
- [GHSA-qp8j-p87f-c8cc: SSRF via LNURL Authentication Callback in LNbits (prior advisory, unrelated)](https://github.com/advisories/GHSA-qp8j-p87f-c8cc)
- [GHSA-3j4h-h3fp-vwww: Improper handling of network and payment failures with Eclair backend (prior advisory, unrelated)](https://github.com/advisories/GHSA-3j4h-h3fp-vwww)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5599