LNbits Urges Users to Shut Down Servers After Attacks

The urgency here stands out: LNbits is telling operators to take servers offline rather than wait for a fix, which signals the flaw is exploitable in the wild, not theoretical. The reported losses came through account creation and withdrawal, pointing at the account and wallet flow rather than a downstream integration. That matters for anyone running a self-hosted Lightning instance, where the operator carries the exposure directly. The open question is whether the promised patch closes the vector or only narrows it, and whether more operators report similar drains in the meantime.