LNbits Disables Hosted Bitcoin Services Following Security Attacks

The Bitcoin payment and wallet-account platform LNbits has issued an urgent directive for all users to halt their servers following a wave of attacks targeting the system. This abrupt shutdown affects critical operational functions, potentially interrupting payment, checkout, and tipping services while system operators await formal security patches and clear guidance on when it is safe to resume operations.

The project supports a wide range of features including point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts, and APIs, catering to both self-managed and self-hosted deployments linked to underlying Lightning funding sources. In an earlier notice on November 8, the platform confirmed it had already disabled all instances running on its hosted service as a precautionary measure, anticipating that services might resume within twenty-four hours. For self-hosted operators, the recent request means manually stopping the LNbits instances they manage for transactions, whereas hosted customers rely entirely on the rapid actions already taken by their provider.

Understanding the GitHub Updates and Repository Changes

As of November 9, the platform's public timeline showed no official all-clear signal, and neither of the previously issued notices provided a confirmed restart clearance for server operators. Compounding the situation, GitHub’s latest-release API continued to identify version 1.6.2 as the stable release, which was originally published on September 18 with notes detailing a PostgreSQL backup hotfix. Meanwhile, developers merged pull request #4310 into the active development branch on November 9, introducing stronger request protections, blocking the server from making requests to itself, and disabling new-account creation by default.

LNbits urged users to stop servers following attacks, leaving operators awaiting security fixes and restart guidance.

Server operators are consequently left navigating two distinct dilemmas: determining which officially released version effectively addresses the recent security incident, and waiting for the project team to explicitly clear servers for a safe restart.

Why it matters

This sudden service disruption highlights the operational vulnerabilities inherent in managing cryptocurrency infrastructure. It directly affects merchants, developers, and platform operators who rely on uninterrupted payment and checkout functionalities for their daily operations, emphasizing the critical need for rapid security patches and transparent communication during infrastructure emergencies.