LNbits disables hosted Bitcoin services with no restart timeline

Bitcoin payments and wallet-account platform LNbits has called on all users to stop their LNbits servers after reporting a wave of attacks.

Stopping those servers can interrupt payment, checkout, and tipping services while operators await security fixes and clear restart guidance. LNbits said it had security patches to push and would provide further updates.

The project's product description lists point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts, and APIs. It supports both self-hosted and managed deployments over underlying Lightning funding sources.

In a separate Nov. 8 notice, LNbits said it had disabled all instances on its hosted service as a precaution and expected services to resume within 24 hours.

For self-hosted operators, the request is to stop the LNbits instance they run for Bitcoin payments. Hosted customers instead depend on the provider's action, which LNbits said it had already taken.

LNbits' shutdown warning follows two hosting paths

Self-hosted operators were told to stop servers; LNbits said it disabled its hosted instances. At the Nov. 9 check, the latest stable release still predated the warning.
LNbits shutdown scope and release status One warning branches to self-hosted operator action and a reported managed-service shutdown. A separate release-status diagram distinguishes the old stable version from a new development merge. SHUTDOWN SCOPE · NOV. 8@lnbitsStop LNbits serversSELF-HOSTEDHOSTED BY LNBITSOperator instructed to stopLNbits says it disabledTheir LNbits serverAll hosted instancesRELEASE STATUS · NOV. 9, ABOUT 18:20 UTCSTABLESept. 18Nov. 9 checkv1.6.2Backup hotfixStill latest stableDEVELOPMENTPR #4310 merged into devNov. 9 · development event, not a stable release
LNbits shutdown scope and release status One warning branches to self-hosted operator action and a reported managed-service shutdown. A separate release-status diagram distinguishes the old stable version from a new development merge. SHUTDOWN SCOPE · NOV. 8@lnbitsStop LNbits serversSELF-HOSTEDHOSTED BY LNBITSOperator toldto stopLNbits saysit disabledTheir serverAll hosted instancesRELEASE STATUSNov. 9 · about 18:20 UTCSTABLESept. 18 · v1.6.2PostgreSQL backup hotfixNov. 9 · still latest stableDEVELOPMENTNov. 9 · PR #4310Merged into dev

The project's shutdown warning spans both hosting arrangements. A development merge is not a stable security release or restart clearance.

Point-in-time public material, about 18:20 UTC Nov. 9, 2026. Hosted shutdown is attributed to @lnbits; restoration was only an estimate. PR #4310 is not established as the attack remedy, and no restart clearance was visible in the reviewed notices/timeline.
Sources and evidence

Sources

1. @lnbits shutdown instruction
2. @lnbits hosted-service notice
3. Latest stable release API
4. LNbits release history
5. PR #4310 merge
6. @lnbits public timeline

Supporting facts

• Reported statement On November 8, @lnbits instructed all LNbits users to stop their LNbits servers immediately, saying it had security patches to push following a wave of attacks. [1]
• @lnbits separately said on November 8 that it had disabled all instances on its hosted service as a precaution and expected services to resume within 24 hours. [2]
• At the November 9 evening check, GitHub identified v1.6.2 as LNbits' latest stable release; its September 18, 2026 release notes describe a PostgreSQL backup hotfix. [3] [4]
• LNbits merged pull request #4310 into its dev branch on November 9, with changes described as centralizing server-side request forgery protection, blocking self-targeted requests and disabling new-account creation by default. [5]
• Reported statement Neither @lnbits' captured November 8 shutdown notice nor its hosted-service notice announced that operators could restart; no later all-clear appeared in the captured public @lnbits timeline at the November 9 evening check. [1] [2] [6]

Method

Qualitative diagram of two hosting responsibilities and separate stable/development status. Dates and labels come from the selected primary statements and GitHub captures; connector lengths are not elapsed time or measured availability.

Scope

Point-in-time public material, about 18:20 UTC Nov. 9, 2026. Hosted shutdown is attributed to @lnbits; restoration was only an estimate. PR #4310 is not established as the attack remedy, and no restart clearance was visible in the reviewed notices/timeline.