Package vulnerability, severity high
LNbits urges all operators to shut down servers amid active attacks draining Lightning wallets
Published
The LNbits project told all operators on 2026-11-08 to shut down their servers because of a wave of attacks. It has several security fixes still to release. One operator reported that new accounts used an exploit to withdraw 2,285,545 satoshis (about 0.023 bitcoin) from his server.
What's affected
- lnbits (pypi)every version
What to do
- Shut down LNbits servers until the security fixes are released
- Be careful with any running instance until the fixes are out
- Apply the security fixes as soon as the project publishes them
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident lnbits-active-exploitation-2026-11References
Notice lnbits-active-exploitation-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.