CryptoSlate
LNbits told all users to stop their servers after a wave of attacks, disrupting access to payment, checkout and tipping services. On Nov. 8, it disabled every instance on its hosted service as a precaution and expected services to resume within 24 hours. As of Nov. 9, GitHub still listed v1.6.2, published Sept. 18, as the latest stable release, while security changes from pull request #4310 had only been merged into the development branch. Neither of the project's two notices provided restart clearance.
Why it matters
LNbits supports self-hosted and managed deployments for point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts and APIs, all funded through Lightning channels. Shutting down an LNbits instance can therefore interrupt services that process real-world Bitcoin payments rather than simply affecting a speculative trading venue.
The security work merged into the development branch adds stronger request protections, blocks the server from making requests to itself and disables new-account creation by default. However, those changes had not produced an identified stable security release or explicit permission to restart.
Market impact
The immediate consequence is operational: payment, checkout and tipping services may remain unavailable, while operators must determine which released version addresses the incident and wait for official restart guidance. Hosted customers depend on LNbits restoring its managed service, while self-hosted operators have been directly instructed to stop their servers.
As of Nov. 9, v1.6.2 remained the latest stable release and was associated with a PostgreSQL backup hotfix. No all-clear had appeared on LNbits' public timeline, so the project had not yet cleared servers for a restart.
Frequently asked questions
-
Which Bitcoin payment services could be affected by the LNbits shutdown?
LNbits powers point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts and APIs. Stopping its servers can interrupt those services, particularly when they use self-hosted or managed LNbits deployments.
-
What action did LNbits take on its hosted service?
LNbits disabled all hosted instances on Nov. 8 as a precaution. In that notice, the project expected services to resume within 24 hours, but it had not issued restart clearance as of Nov. 9.
-
Which LNbits version was the latest stable release on Nov. 9?
GitHub still listed v1.6.2 as the latest stable release. Published Sept. 18, its release notes described a PostgreSQL backup hotfix.
-
What security changes did LNbits merge into development?
Pull request #4310 added stronger request protections, prevented the server from making requests to itself and disabled new-account creation by default. It had not yet been released as a stable security version.
-
What must LNbits operators do before restarting their servers?
Operators were told to stop their LNbits instances and await explicit restart guidance. They also need to identify which released version addresses the incident, since the merged security changes were not yet a stable release.
CoinDesk
Crypto News
WuBlockchain
WatcherGuru