Overview
- Attackers exploited LNbits instances to open new accounts and withdraw funds without authorization, with the BitTipBot operator reporting a loss of about 2,285,545 sats.
- The BitTipBot breach ran roughly 09:22–14:00 UTC and began before LNbits issued its first public advisory asking operators to disable an add‑on.
- LNbits told all operators to shut down servers and took its hosted my.lnbits.com service offline while developers prepare multiple security patches expected to be merged within 24–48 hours.
- Project and operator posts say the exploit used an LNbits extension; the project’s initial narrow warning named the Paywall add‑on but the exact vulnerable extension has not been publicly disclosed.
- Because LNbits is commonly self‑hosted for tip bots, shared wallets and point‑of‑sale setups, individual operators must act on advisories alone, which slows containment and forces reimbursement promises to wait on upstream fixes.