LNbits disables hosted Bitcoin services with no restart timeline

Bitcoin payments and wallet-account platform LNbits has called on all users to stop their LNbits servers after reporting a wave of attacks.

Stopping those servers can interrupt payment, checkout, and tipping services while operators await security fixes and clear restart guidance. LNbits said it had security patches to push and would provide further updates.

The project's product description lists point-of-sale tools, online checkout, donation buttons, tipping, wallet accounts, and APIs. It supports both self-hosted and managed deployments over underlying Lightning funding sources.

In a separate Nov. 8 notice, LNbits said it had disabled all instances on its hosted service as a precaution and expected services to resume within 24 hours.

For self-hosted operators, the request is to stop the LNbits instance they run for Bitcoin payments. Hosted customers instead depend on the provider’s action, which LNbits said it had already taken.

Latest stable release predates the shutdown warning for Bitcoin payments

As of Nov. 9, GitHub’s latest-release API still identified v1.6.2 as LNbits’ latest stable release. Published Sept. 18, its release notes describe a PostgreSQL backup hotfix.

LNbits merged pull request #4310 into its development branch on Nov. 9. The descriptions cover stronger request protections, blocking the server from making requests to itself, and disabling new-account creation by default.

No all-clear was visible on LNbits' public timeline, and neither of its two notices announced restart clearance.

Operators face two separate questions: which released version addresses the incident, and when the project will explicitly clear servers to restart.