LNbits disables hosted Bitcoin services with no restart timeline

Bitcoin payments and wallet-account platform LNbits has called on all users to stop their LNbits servers after reporting a wave of attacks.

Stopping those servers can interrupt payment, checkout, and tipping services while operators await security fixes and clear restart guidance. LNbits said it had security patches to push and would provide further updates.

The project's product description lists point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts, and APIs. It supports both self-hosted and managed deployments over underlying Lightning funding sources.

In a separate Nov. 8 notice, LNbits said it had disabled all instances on its hosted service as a precaution and expected services to resume within 24 hours.

For self-hosted operators, the request is to stop the LNbits instance they run for Bitcoin payments. Hosted customers instead depend on the provider’s action, which LNbits said it had already taken.

The project’s shutdown warning spans both hosting arrangements. A development merge is not a stable security release or restart clearance.

Point-in-time public material, about 18:20 UTC Nov. 9, 2026. Hosted shutdown is attributed to @lnbits; restoration was only an estimate. PR #4310 is not established as the attack remedy, and no restart clearance was visible in the reviewed notices/timeline.

Sources and evidence

Sources

1. @lnbits shutdown instruction
2. @lnbits hosted-service notice
3. Latest stable release API
4. LNbits release history
5. PR #4310 merge
6. @lnbits public timeline

Supporting facts

• Reported statement On November 8, @lnbits instructed all LNbits users to stop their LNbits servers immediately, saying it had security patches to push following a wave of attacks. [1]
• @lnbits separately said on November 8 that it had disabled all instances on its hosted service as a precaution and expected services to resume within 24 hours. [2]
• At the November 9 evening check, GitHub identified v1.6.2 as LNbits’ latest stable release; its September 18, 2026 release notes describe a PostgreSQL backup hotfix. [3] [4]
• LNbits merged pull request #4310 into its dev branch on November 9, with changes described as centralizing server-side request forgery protection, blocking self-targeted requests and disabling new-account creation by default. [5]
• Reported statement Neither @lnbits’ captured November 8 shutdown notice nor its hosted-service notice announced that operators could restart; no later all-clear appeared in the captured public @lnbits timeline at the November 9 evening check. [1] [2] [6]

Method

Qualitative diagram of two hosting responsibilities and separate stable/development status. Dates and labels come from the selected primary statements and GitHub captures; connector lengths are not elapsed time or measured availability.

Scope

Point-in-time public material, about 18:20 UTC Nov. 9, 2026. Hosted shutdown is attributed to @lnbits; restoration was only an estimate. PR #4310 is not established as the attack remedy, and no restart clearance was visible in the reviewed notices/timeline.

Infographic by CryptoSlate

Latest stable release predates the shutdown warning for Bitcoin payments

As of Nov. 9, GitHub’s latest-release API still identified v1.6.2 as LNbits’ latest stable release. Published Sept. 18, its release notes describe a PostgreSQL backup hotfix.

LNbits merged pull request #4310 into its development branch on Nov. 9. The descriptions cover stronger request protections, blocking the server from making requests to itself, and disabling new-account creation by default.

No all-clear was visible on LNbits' public timeline, and neither of its two notices announced restart clearance.

Operators face two separate questions: which released version addresses the incident, and when the project will explicitly clear servers to restart.