LNbits has shut down its hosted Bitcoin services with no timeline for restoration, leaving users in limbo after a security change quietly merged into development on November 9.
No fanfare. No warning. Just a switch flipped off — and silence on when it comes back on.
The shutdown stems from a security-related code change merged into the LNbits development branch earlier this month. What makes this particularly alarming is the gap between what was happening behind the scenes and what users could see publicly. As of the shutdown, GitHub was still showing a September backup hotfix as the latest stable release, meaning anyone checking the repository for reassurance would have seen nothing that telegraphed this was coming.
That's not a minor communication fumble. That's a critical mismatch between the public-facing state of a project and what was actually happening under the hood.
Why This Matters Beyond LNbits
LNbits is an open-source Lightning Network wallet and account system built on top of Bitcoin's Layer 2 payment infrastructure. It's widely used by developers, small businesses, and Bitcoin communities running their own nodes or relying on hosted instances to manage Lightning payments.
When a tool this embedded in the Bitcoin Lightning ecosystem goes dark with no restart timeline, it doesn't just inconvenience hobbyists. It disrupts actual payment flows, merchant setups, and community wallets that depend on the platform staying live.
The deeper issue here is trust. Lightning Network infrastructure is already a hard sell to skeptics who point to complexity and custody risk as reasons to stay on-chain. An opaque security-driven shutdown, with no public disclosure of what the vulnerability actually was, hands those critics exactly the ammunition they want.
What We Still Don't Know
The nature of the security vulnerability has not been publicly disclosed. That could be responsible disclosure practice, buying time before bad actors exploit the same flaw elsewhere. Or it could be a sign that the team is still assessing the damage. Neither interpretation is particularly comforting.
There is also no clarity on whether user funds or data were at risk, which is the question every person with an active hosted LNbits wallet is asking right now.
What to Watch
If you are running a self-hosted LNbits instance, audit your setup immediately and monitor the official LNbits GitHub and communication channels for any security advisory that follows. If you were relying on a third-party hosted LNbits service, treat your funds as inaccessible until confirmed otherwise and do not assume the September release on GitHub reflects the current security posture.
The broader signal for Bitcoin Lightning developers: the gap between dev-branch changes and public release transparency is a liability the ecosystem cannot keep ignoring.