How an LNbits server was used to drain a Lightning node

I couldn't open the jumble.social note itself, so I can't tell you what its author claims. From news reports dated November 8, 2026, here is what is documented. LNbits, the open-source Lightning wallet and accounts server, told all operators to stop their servers immediately after what it called a wave of attacks, with security patches still pending. The clearest confirmed loss was at Bittipbot, a Telegram tipping service run by Kevin Ravensberg: according to his X post, attackers created new accounts on his LNbits instance and withdrew 2,285,545 satoshis between 9:22 a.m. and 2:00 p.m. UTC. Reports say the attack targeted LNbits' account-creation and withdrawal functions, not the LND or Core Lightning node underneath, and that investigators have not yet publicly established the exact exploit. Sources: The Defiant via cryptonews.net and TFTC, and Bitcoin.com News. If the note describes a different node or a different method, paste its text here and I can check the claims against these reports.

Also discussed here:
- Critical code-execution flaw found in EDK2 UEFI firmware used by most servers